Update dependencies

Base prevention of replay attacks on proxy

.golangci.toml

@@ -10,3 +10,4 @@ format = "colored-line-number"
 
 [linters]
 enable-all = true
+disable = ["gochecknoglobals"]

.travis.yml

@@ -5,8 +5,8 @@ sudo: false
 dist: trusty
 
 go:
-  - "1.9.x"
+  - "1.11.x"
-  - "1.10.x"
+  - 1.12.x
   - master
 
 before_script: make prepare
@@ -14,13 +14,8 @@ before_script: make prepare
 script:
   - make all
   - make lint
-  - make critic
   - make test
 
-cache:
-  directories:
-    - vendor
-
 matrix:
   allow_failures:
     - go: master

Dockerfile

@@ -1,7 +1,7 @@
 ###############################################################################
 # BUILD STAGE
 
-FROM golang:alpine
+FROM golang:1.12-alpine
 
 RUN set -x \
   && apk --no-cache --update add \
@@ -10,17 +10,9 @@ RUN set -x \
     curl \
     git \
     make \
-    upx \
+    upx
-  && update-ca-certificates
 
-COPY Gopkg.toml Gopkg.lock Makefile /go/src/github.com/9seconds/mtg/
+COPY . /go/src/github.com/9seconds/mtg/
-
-RUN set -x && \
-  cd /go/src/github.com/9seconds/mtg && \
-  make -j 4 prepare && \
-  make vendor
-
-COPY . /go/src/github.com/9seconds/mtg
 
 RUN set -x \
   && cd /go/src/github.com/9seconds/mtg \
@@ -33,7 +25,7 @@ RUN set -x \
 
 FROM scratch
 
-ENTRYPOINT ["/usr/local/bin/mtg"]
+ENTRYPOINT ["/mtg"]
 ENV MTG_IP=0.0.0.0 \
     MTG_PORT=3128 \
     MTG_STATS_IP=0.0.0.0 \
@@ -41,4 +33,4 @@ ENV MTG_IP=0.0.0.0 \
 EXPOSE 3128 3129
 
 COPY --from=0 /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
-COPY --from=0 /go/src/github.com/9seconds/mtg/mtg /usr/local/bin/mtg
+COPY --from=0 /go/src/github.com/9seconds/mtg/mtg /mtg

Gopkg.lock

@@ -1,154 +0,0 @@
-# This file is autogenerated, do not edit; changes may be undone by the next 'dep ensure'.
-
-
-[[projects]]
-  branch = "master"
-  digest = "1:315c5f2f60c76d89b871c73f9bd5fe689cad96597afd50fb9992228ef80bdd34"
-  name = "github.com/alecthomas/template"
-  packages = [
-    ".",
-    "parse",
-  ]
-  pruneopts = "UT"
-  revision = "a0175ee3bccc567396460bf5acd36800cb10c49c"
-
-[[projects]]
-  branch = "master"
-  digest = "1:c198fdc381e898e8fb62b8eb62758195091c313ad18e52a3067366e1dda2fb3c"
-  name = "github.com/alecthomas/units"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "2efee857e7cfd4f3d0138cc3cbb1b4966962b93a"
-
-[[projects]]
-  digest = "1:a8d622a8049a4aa420e1c509873bb85d4c45c5107f420d922f919bfcb8d08694"
-  name = "github.com/beevik/ntp"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "62c80a04de2086884d8296004b6d74ee1846c582"
-  version = "v0.2.0"
-
-[[projects]]
-  digest = "1:a2c1d0e43bd3baaa071d1b9ed72c27d78169b2b269f71c105ac4ba34b1be4a39"
-  name = "github.com/davecgh/go-spew"
-  packages = ["spew"]
-  pruneopts = "UT"
-  revision = "346938d642f2ec3594ed81d874461961cd0faa76"
-  version = "v1.1.0"
-
-[[projects]]
-  branch = "master"
-  digest = "1:6f9339c912bbdda81302633ad7e99a28dfa5a639c864061f1929510a9a64aa74"
-  name = "github.com/dustin/go-humanize"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "9f541cc9db5d55bce703bd99987c9d5cb8eea45e"
-
-[[projects]]
-  branch = "master"
-  digest = "1:53bd4347b151fcbedcdda527f7ebf4924f0e21d672131812f857175d8c7a1051"
-  name = "github.com/juju/errors"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "812b06ada1776ad4dd95d575e18ffffe3a9ac34a"
-
-[[projects]]
-  digest = "1:0028cb19b2e4c3112225cd871870f2d9cf49b9b4276531f03438a88e94be86fe"
-  name = "github.com/pmezard/go-difflib"
-  packages = ["difflib"]
-  pruneopts = "UT"
-  revision = "792786c7400a136282c1664665ae0a8db921c6c2"
-  version = "v1.0.0"
-
-[[projects]]
-  digest = "1:274f67cb6fed9588ea2521ecdac05a6d62a8c51c074c1fccc6a49a40ba80e925"
-  name = "github.com/satori/go.uuid"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "f58768cc1a7a7e77a3bd49e98cdd21419399b6a3"
-  version = "v1.2.0"
-
-[[projects]]
-  digest = "1:18752d0b95816a1b777505a97f71c7467a8445b8ffb55631a7bf779f6ba4fa83"
-  name = "github.com/stretchr/testify"
-  packages = ["assert"]
-  pruneopts = "UT"
-  revision = "f35b8ab0b5a2cef36673838d662e249dd9c94686"
-  version = "v1.2.2"
-
-[[projects]]
-  digest = "1:3c1a69cdae3501bf75e76d0d86dc6f2b0a7421bc205c0cb7b96b19eed464a34d"
-  name = "go.uber.org/atomic"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "1ea20fb1cbb1cc08cbd0d913a96dead89aa18289"
-  version = "v1.3.2"
-
-[[projects]]
-  digest = "1:60bf2a5e347af463c42ed31a493d817f8a72f102543060ed992754e689805d1a"
-  name = "go.uber.org/multierr"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "3c4937480c32f4c13a875a1829af76c98ca3d40a"
-  version = "v1.1.0"
-
-[[projects]]
-  digest = "1:d9a420eae5f76973feeb733fbf58f6a89173255b63b27a7ae4b2124a73dc6c5b"
-  name = "go.uber.org/zap"
-  packages = [
-    ".",
-    "buffer",
-    "internal/bufferpool",
-    "internal/color",
-    "internal/exit",
-    "zapcore",
-  ]
-  pruneopts = "UT"
-  revision = "4d45f9617f7d90f7a663ff21c7a4321dbe78098b"
-  version = "v1.9.0"
-
-[[projects]]
-  branch = "master"
-  digest = "1:becb2131aece71c64ebca5ddfd38cf631784fbb3a678d73ead3b42107c9f41ce"
-  name = "golang.org/x/net"
-  packages = [
-    "bpf",
-    "internal/iana",
-    "internal/socket",
-    "ipv4",
-  ]
-  pruneopts = "UT"
-  revision = "3673e40ba22529d22c3fd7c93e97b0ce50fa7bdd"
-
-[[projects]]
-  digest = "1:c06d9e11d955af78ac3bbb26bd02e01d2f61f689e1a3bce2ef6fb683ef8a7f2d"
-  name = "gopkg.in/alecthomas/kingpin.v2"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "947dcec5ba9c011838740e680966fd7087a71d0d"
-  version = "v2.2.6"
-
-[[projects]]
-  digest = "1:38b469493eb173db9c03321d64adcad4c7991ea0a19b5edc5bdc094f0e8c7384"
-  name = "gopkg.in/alexcesaro/statsd.v2"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "7fea3f0d2fab1ad973e641e51dba45443a311a90"
-  version = "v2.0.0"
-
-[solve-meta]
-  analyzer-name = "dep"
-  analyzer-version = 1
-  input-imports = [
-    "github.com/beevik/ntp",
-    "github.com/dustin/go-humanize",
-    "github.com/juju/errors",
-    "github.com/satori/go.uuid",
-    "github.com/stretchr/testify/assert",
-    "go.uber.org/zap",
-    "go.uber.org/zap/zapcore",
-    "gopkg.in/alecthomas/kingpin.v2",
-    "gopkg.in/alexcesaro/statsd.v2",
-  ]
-  solver-name = "gps-cdcl"
-  solver-version = 1

Gopkg.toml

@@ -1,58 +0,0 @@
-# Gopkg.toml example
-#
-# Refer to https://golang.github.io/dep/docs/Gopkg.toml.html
-# for detailed Gopkg.toml documentation.
-#
-# required = ["github.com/user/thing/cmd/thing"]
-# ignored = ["github.com/user/project/pkgX", "bitbucket.org/user/project/pkgA/pkgY"]
-#
-# [[constraint]]
-#   name = "github.com/user/project"
-#   version = "1.0.0"
-#
-# [[constraint]]
-#   name = "github.com/user/project2"
-#   branch = "dev"
-#   source = "github.com/myfork/project2"
-#
-# [[override]]
-#   name = "github.com/x/y"
-#   version = "2.4.0"
-#
-# [prune]
-#   non-go = false
-#   go-tests = true
-#   unused-packages = true
-
-
-[prune]
-  go-tests = true
-  unused-packages = true
-
-[[constraint]]
-  name = "gopkg.in/alecthomas/kingpin.v2"
-  version = "2.2.6"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/juju/errors"
-
-[[constraint]]
-  name = "github.com/stretchr/testify"
-  version = "1.2.1"
-
-[[constraint]]
-  name = "github.com/satori/go.uuid"
-  version = "1.2.0"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/dustin/go-humanize"
-
-[[constraint]]
-  name = "github.com/beevik/ntp"
-  version = "0.2.0"
-
-[[constraint]]
-  name = "gopkg.in/alexcesaro/statsd.v2"
-  version = "2.0.0"

Makefile

@@ -2,26 +2,30 @@ ROOT_DIR     := $(shell dirname $(realpath $(lastword $(MAKEFILE_LIST))))
 IMAGE_NAME   := mtg
 APP_NAME     := $(IMAGE_NAME)
 
-VENDOR_FILES := $(shell find "$(ROOT_DIR)/vendor" 2>/dev/null || echo -n "vendor")
 CC_BINARIES  := $(shell bash -c "echo -n $(APP_NAME)-{linux,freebsd,openbsd}-{386,amd64} $(APP_NAME)-linux-{arm,arm64}")
-APP_DEPS     := version.go $(VENDOR_FILES)
 
-GOLANGCI_LINT_VERSION := v1.9.2
+GOLANGCI_LINT_VERSION := v1.15.0
 
-COMMON_BUILD_FLAGS := -ldflags="-s -w"
+VERSION_GO         := $(shell go version)
+VERSION_DATE       := $(shell date -Ru)
+VERSION_TAG        := $(shell git describe --tags --always)
+COMMON_BUILD_FLAGS := -ldflags="-s -w -X 'main.version=$(VERSION_TAG) ($(VERSION_GO)) [$(VERSION_DATE)]'"
+
+MOD_ON  := env GO111MODULE=on
+MOD_OFF := env GO111MODULE=auto
 
 # -----------------------------------------------------------------------------
 
-$(APP_NAME): $(APP_DEPS)
+$(APP_NAME):
-	@go build $(COMMON_BUILD_FLAGS) -o "$(APP_NAME)"
+	@$(MOD_ON) go build $(COMMON_BUILD_FLAGS) -o "$(APP_NAME)"
 
-static-$(APP_NAME): $(APP_DEPS)
+static-$(APP_NAME):
-	@env CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo $(COMMON_BUILD_FLAGS) -o "$(APP_NAME)"
+	@$(MOD_ON) env CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo $(COMMON_BUILD_FLAGS) -o "$(APP_NAME)"
 
 $(APP_NAME)-%: GOOS=$(shell echo -n "$@" | sed 's?$(APP_NAME)-??' | cut -f1 -d-)
 $(APP_NAME)-%: GOARCH=$(shell echo -n "$@" | sed 's?$(APP_NAME)-??' | cut -f2 -d-)
-$(APP_NAME)-%: $(APP_DEPS) ccbuilds
+$(APP_NAME)-%: ccbuilds
-	@env "GOOS=$(GOOS)" "GOARCH=$(GOARCH)" \
+	@$(MOD_ON) env "GOOS=$(GOOS)" "GOARCH=$(GOARCH)" \
 		go build \
 		$(COMMON_BUILD_FLAGS) \
 		-o "./ccbuilds/$(APP_NAME)-$(GOOS)-$(GOARCH)"
@@ -29,11 +33,8 @@ $(APP_NAME)-%: $(APP_DEPS) ccbuilds
 ccbuilds:
 	@rm -rf ./ccbuilds && mkdir -p ./ccbuilds
 
-version.go:
+vendor: go.mod go.sum
-	@go generate main.go
+	@$(MOD_ON) go mod vendor
-
-vendor: Gopkg.lock Gopkg.toml
-	@dep ensure --vendor-only
 
 # -----------------------------------------------------------------------------
 
@@ -51,16 +52,12 @@ crosscompile-dir:
 	@rm -rf "$(CC_DIR)" && mkdir -p "$(CC_DIR)"
 
 .PHONY: test
-test: vendor version.go
+test: vendor
-	@go test -v ./...
+	@$(MOD_ON) go test -v ./...
 
 .PHONY: lint
-lint: version.go
+lint: vendor
-	@golangci-lint run
+	@$(MOD_OFF) golangci-lint run
-
-.PHONY: critic
-critic: version.go
-	@gocritic check-project "$(ROOT_DIR)"
 
 .PHONY: clean
 clean:
@@ -73,17 +70,9 @@ docker:
 	@docker build --pull -t "$(IMAGE_NAME)" "$(ROOT_DIR)"
 
 .PHONY: prepare
-prepare: install-dep install-lint install-critic
+prepare: install-lint
-
-.PHONY: install-dep
-install-dep:
-	@go get -u github.com/golang/dep/cmd/dep
 
 .PHONY: install-lint
 install-lint:
 	@curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh \
-		| bash -s -- -b $(GOPATH)/bin $(GOLANGCI_LINT_VERSION)
+		| $(MOD_OFF) bash -s -- -b $(GOPATH)/bin $(GOLANGCI_LINT_VERSION)
-
-.PHONY: install-critic
-install-critic:
-	@go get -u github.com/go-critic/go-critic/...

README.md

@@ -3,6 +3,7 @@
 Bullshit-free MTPROTO proxy for Telegram
 
 [![Build Status](https://travis-ci.org/9seconds/mtg.svg?branch=master)](https://travis-ci.org/9seconds/mtg)
+[![Go Report Card](https://goreportcard.com/badge/github.com/9seconds/mtg)](https://goreportcard.com/report/github.com/9seconds/mtg)
 [![Docker Build Status](https://img.shields.io/docker/build/nineseconds/mtg.svg)](https://hub.docker.com/r/nineseconds/mtg/)
 
 # Rationale
@@ -32,7 +33,7 @@ mtg is an implementation in golang which is intended to be:
   software. I also believe that in case of throwout proxies, this feature
   is useless luxury.
 * **Minimum docker image size**
-  Official image is less than 2.5 megabytes. Literally.
+  Official image is less than 3 megabytes. Literally.
 * **No management WebUI**
   This is an implementation of simple lightweight proxy. I won't do that.
 
@@ -94,6 +95,11 @@ docker pull nineseconds/mtg:stable
 docker pull nineseconds/mtg:0.10
 ```
 
+# Ansible role
+
+You can find unofficial Ansible role for mtg here: https://github.com/rlex/ansible-role-mtg
+Also, there is another project on Ansible Galaxy: https://galaxy.ansible.com/ivansible/lin_mtproxy
+
 # Configuration
 
 Basically, to run this tool you need to configure as less as possible.
@@ -112,11 +118,58 @@ head -c 512 /dev/urandom | md5sum | cut -f 1 -d ' '
 
 ## Secure mode
 
-If you want to support new secure mode, please prepend `dd` to the
+_tl;dr - use secret mode for all new installation of proxy; only clients
-secret. For example, secret `cf18fa8ea0267057e2c61a5f7322a8e7` should
+with dd-secrets will be able to connect. This mode abuses attempts to
-be `ddcf18fa8ea0267057e2c61a5f7322a8e7`. But pay attention that some
+DPI MTPROTO traffic._
-old clients won't support this mode. If this is not your case, I would
+
-suggest to go with this mode.
+Secure mode is not the best name and of course, it creates a lot of
+confusion. To explain what it means, we need to tell you some bits on
+dd-secrets.
+
+MTPROTO proxy protocol requires 16-byte secret. You usually
+propagate it as a 32 characters hexadecimal string like
+`282831900f371ca182feb0e4e1e1aeef` (if you decode this string
+to bytes, you will get a real secret which is used in the
+protocol). Everything went quite good until the moment when
+developers found an evidence that [protocol is quite weak to
+DPI](https://github.com/TelegramMessenger/MTProxy/issues/35) and some
+enthusiasts even created simple proofs of concepts on [detecting MTPROTO
+traffic](https://github.com/darkk/poormansmtproto).
+
+Telegram team has introduced a patch called dd-secrets. If you have
+a secret `282831900f371ca182feb0e4e1e1aeef` then your dd-secret is
+`dd282831900f371ca182feb0e4e1e1aeef`. That is, you just add dd prefix
+to the secret, prepend it with dd. In that case, original secret
+`282831900f371ca182feb0e4e1e1aeef` is used but client and server start
+to act a little bit different: they start to add random noise to the
+packets so they can't be detected by their length. In order to keep
+backward compatibility, all proxies a quite liberal to the secrets to
+use: if the client uses plain secret, without dd prefix, they fall back
+to the normal behavior. If dd-secret is used (proxy can extract this
+information on the handshake), then more secured, the hardened behavior
+is used.
+
+Yes, it can look like a hack but it is as it is.
+
+Now going back to the secure mode: if you do not pass `-s` flag to the
+mtg, then it checks what mode is requested by the client. If the client
+uses plain secret, without dd prefix, then proxy falls back to the
+original behavior and do not play with paddings. If dd-secret is used
+and client demands this mode, then proxy start to add that random noise
+to the packets. But if you pass `-s`, then only clients with dd-secrets
+can connect. How to migrate existing clients then? If a client is new
+enough, you can just prepend the secret with dd string in the settings.
+If it is an old guy, then nothing to do, sorry.
+
+Why this mode matters? We do not have evidence but there is quite a big
+suspicion that some ISPs start to filter MTPROTO traffic. If they detect
+the IP address which acts as a proxy, they block it and no clients can
+use this proxy. This is an attempt to prevent such a situation.
+
+General rule of thumb: with all new installation of proxies I would
+advise to go with secure mode by default. But please do remember that it
+means that clients, which do not pass dd-prefix to their secrets, will
+not be able to connect. *Secure mode works only with dd-prefixes!*
 
 Oneliners to generate such secrets:
 
@@ -130,32 +183,46 @@ or
 echo dd$(head -c 512 /dev/urandom | md5sum | cut -f 1 -d ' ')
 ```
 
+
+## Antireplay cache
+
+In order to prevent replay attacks, we have internal storage of first
+frames messages for connected clients. These frames are generated
+randomly by design and we have negligible possibility of duplication
+(probability is 1/(2^64)) but it could be quite effective in order to
+prevent replays.
+
+
 ## Environment variables
 
 It is possible to configure this tool using environment variables. You
 can configure any flag but not secret or adtag. Here is the list of
 supported environment variables:
 
-| Environment variable     | Corresponding flags    | Default value                     | Description                                                                                                                                                                                                                                                                |
+| Environment variable          | Corresponding flags         | Default value                     | Description                                                                                                                                                                                                                                                                |
-|--------------------------|------------------------|-----------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+|-------------------------------|-----------------------------|-----------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `MTG_DEBUG`              | `-d`, `--debug`        | `false`                           | Run in debug mode. Usually, you need to run in this mode  only if you develop this tool or its maintainer is asking you to provide  logs with such verbosity.                                                                                                              |
+| `MTG_DEBUG`                   | `-d`, `--debug`             | `false`                           | Run in debug mode. Usually, you need to run in this mode  only if you develop this tool or its maintainer is asking you to provide  logs with such verbosity.                                                                                                              |
-| `MTG_VERBOSE`            | `-v`, `--verbose`      | `false`                           | Run in verbose mode. This is way less chatty than debug mode.                                                                                                                                                                                                              |
+| `MTG_VERBOSE`                 | `-v`, `--verbose`           | `false`                           | Run in verbose mode. This is way less chatty than debug mode.                                                                                                                                                                                                              |
-| `MTG_IP`                 | `-b`, `--bind-ip`      | `127.0.0.1`                       | Which IP should we bind to. As usual, `0.0.0.0` means that we want to listen on all interfaces. Also, 4 zeroes will bind to both IPv4 and IPv6.                                                                                                                            |
+| `MTG_IP`                      | `-b`, `--bind-ip`           | `127.0.0.1`                       | Which IP should we bind to. As usual, `0.0.0.0` means that we want to listen on all interfaces. Also, 4 zeroes will bind to both IPv4 and IPv6.                                                                                                                            |
-| `MTG_PORT`               | `-p`, `--bind-port`    | `3128`                            | Which port should we bind to (listen on).                                                                                                                                                                                                                                  |
+| `MTG_PORT`                    | `-p`, `--bind-port`         | `3128`                            | Which port should we bind to (listen on).                                                                                                                                                                                                                                  |
-| `MTG_IPV4`               | `-4`, `--public-ipv4`  | [Autodetect](https://ifconfig.co) | IPv4 address of this proxy. This is required if you NAT your proxy or run it in a docker container. In that case, you absolutely need to specify public IPv4 address of the proxy, otherwise either URLs will be broken or proxy could not access Telegram middle proxies. |
+| `MTG_IPV4`                    | `-4`, `--public-ipv4`       | [Autodetect](https://ifconfig.co) | IPv4 address of this proxy. This is required if you NAT your proxy or run it in a docker container. In that case, you absolutely need to specify public IPv4 address of the proxy, otherwise either URLs will be broken or proxy could not access Telegram middle proxies. |
-| `MTG_IPV4_PORT`          | `--public-ipv4-port`   | Value of `--bind-port`            | Which port should be public of IPv4 interface. This affects only generated links and should be changed only if you NAT your proxy or run it in a docker container.                                                                                                         |
+| `MTG_IPV4_PORT`               | `--public-ipv4-port`        | Value of `--bind-port`            | Which port should be public of IPv4 interface. This affects only generated links and should be changed only if you NAT your proxy or run it in a docker container.                                                                                                         |
-| `MTG_IPV6`               | `-6`, `--public-ipv6`  | [Autodetect](https://ifconfig.co) | IPv6 address of this proxy. This is required if you NAT your proxy or run it in a docker container. In that case, you absolutely need to specify public IPv6 address of the proxy, otherwise either URLs will be broken or proxy could not access Telegram middle proxies. |
+| `MTG_IPV6`                    | `-6`, `--public-ipv6`       | [Autodetect](https://ifconfig.co) | IPv6 address of this proxy. This is required if you NAT your proxy or run it in a docker container. In that case, you absolutely need to specify public IPv6 address of the proxy, otherwise either URLs will be broken or proxy could not access Telegram middle proxies. |
-| `MTG_IPV6_PORT`          | `--public-ipv6-port`   | Value of `--bind-port`            | Which port should be public of IPv6 interface. This affects only generated links and should be changed only if you NAT your proxy or run it in a docker container.                                                                                                         |
+| `MTG_IPV6_PORT`               | `--public-ipv6-port`        | Value of `--bind-port`            | Which port should be public of IPv6 interface. This affects only generated links and should be changed only if you NAT your proxy or run it in a docker container.                                                                                                         |
-| `MTG_STATS_IP`           | `-t`, `--stats-ip`     | `127.0.0.1`                       | Which IP should we bind the internal statistics HTTP server.                                                                                                                                                                                                               |
+| `MTG_STATS_IP`                | `-t`, `--stats-ip`          | `127.0.0.1`                       | Which IP should we bind the internal statistics HTTP server.                                                                                                                                                                                                               |
-| `MTG_STATS_PORT`         | `-q`, `--stats-port`   | `3129`                            | Which port should we bind the internal statistics HTTP server.                                                                                                                                                                                                             |
+| `MTG_STATS_PORT`              | `-q`, `--stats-port`        | `3129`                            | Which port should we bind the internal statistics HTTP server.                                                                                                                                                                                                             |
-| `MTG_STATSD_IP`          | `--statsd-ip`          |                                   | IP/host addresses of statsd service. No defaults, by defaults we do not send anything there.                                                                                                                                                                               |
+| `MTG_STATSD_IP`               | `--statsd-ip`               |                                   | IP/host addresses of statsd service. No defaults, by defaults we do not send anything there.                                                                                                                                                                               |
-| `MTG_STATSD_PORT`        | `--statsd-port`        | `8125`                            | Which port should we use to work with statsd.                                                                                                                                                                                                                              |
+| `MTG_STATSD_PORT`             | `--statsd-port`             | `8125`                            | Which port should we use to work with statsd.                                                                                                                                                                                                                              |
-| `MTG_STATSD_NETWORK`     | `--statsd-network`     | `udp`                             | Which protocol should we use to work with statsd. Possible options are `udp` and `tcp`.                                                                                                                                                                                    |
+| `MTG_STATSD_NETWORK`          | `--statsd-network`          | `udp`                             | Which protocol should we use to work with statsd. Possible options are `udp` and `tcp`.                                                                                                                                                                                    |
-| `MTG_STATSD_PREFIX`      | `--statsd-prefix`      | `mtg`                             | Which bucket prefix we should use. For example, if you set `mtg`, then metric `traffic.ingress` would be send as `mtg.traffic.ingress`.                                                                                                                                    |
+| `MTG_STATSD_PREFIX`           | `--statsd-prefix`           | `mtg`                             | Which bucket prefix we should use. For example, if you set `mtg`, then metric `traffic.ingress` would be send as `mtg.traffic.ingress`.                                                                                                                                    |
-| `MTG_STATSD_TAGS_FORMAT` | `--statsd-tags-format` |                                   | Which tags format we should use. By default, we are using default vanilla statsd tags format but if you want to send directly to InfluxDB or Datadog, please specify it there. Possible options are `influxdb` and `datadog`.                                              |
+| `MTG_STATSD_TAGS_FORMAT`      | `--statsd-tags-format`      |                                   | Which tags format we should use. By default, we are using default vanilla statsd tags format but if you want to send directly to InfluxDB or Datadog, please specify it there. Possible options are `influxdb` and `datadog`.                                              |
-| `MTG_STATSD_TAGS`        | `--statsd-tags`        |                                   | Which tags should we send to statsd with our metrics. Please specify them as `key=value` pairs.                                                                                                                                                                            |
+| `MTG_STATSD_TAGS`             | `--statsd-tags`             |                                   | Which tags should we send to statsd with our metrics. Please specify them as `key=value` pairs.                                                                                                                                                                            |
-| `MTG_BUFFER_WRITE`       | `-w`, `--write-buffer` | `65536`                           | The size of TCP write buffer in bytes. Write buffer is the buffer for messages which are going from client to Telegram.                                                                                                                                                    |
+| `MTG_PROMETHEUS_PREFIX`       | `--prometheus-prefix`       | `mtg`                             | Which namespace should be used for prometheus metrics.                                                                                                                                                                                                                     |
-| `MTG_BUFFER_READ`        | `-r`, `--read-buffer`  | `131072`                          | The size of TCP read buffer in bytes. Read buffer is the buffer for messages from Telegram to client.                                                                                                                                                                      |
+| `MTG_BUFFER_WRITE`            | `-w`, `--write-buffer`      | `65536`                           | The size of TCP write buffer in bytes. Write buffer is the buffer for messages which are going from client to Telegram.                                                                                                                                                    |
+| `MTG_BUFFER_READ`             | `-r`, `--read-buffer`       | `131072`                          | The size of TCP read buffer in bytes. Read buffer is the buffer for messages from Telegram to client.                                                                                                                                                                      |
+| `MTG_SECURE_ONLY`             | `-s`, `--secure-only`       | `false`                           | Support only clients with secure mode (i.e only clients with dd-secrets).                                                                                                                                                                                                  |
+| `MTG_ANTIREPLAY_MAXSIZE`      | `anti-replay-max-size`      | `128`                             | Max size of antireplay cache in megabytes.                                                                                                                                                                                                                                 |
+| `MTG_ANTIREPLAY_EVICTIONTIME` | `anti-replay-eviction-time` | `168h`                            | Eviction time for antireplay cache entries.                                                                                                                                                                                                                                |
 
 Usually you want to modify only read/write buffer sizes. If you feel
 that proxy is slow, try to increase both sizes giving more priority to
@@ -228,3 +295,14 @@ All metrics are gauges. Here is the list of metrics and their meaning:
 All metrics are prefixed with given prefix. Default prefix is `mtg`.
 With such prefix metric name `traffic.ingress`, for example, would be
 `mtg.traffic.ingress`.
+
+
+# Prometheus integration
+
+[Prometheus](https://prometheus.io) integration comes out of
+the box, you do not need to setup anything special. Prometheus
+scrape endpoint lives on the same IP/port where generic stats
+service (`http://${MTG_STATS_IP}:${MTG_STATS_PORT}`) but on
+`/prometheus` path. So, if you access http stats service as `curl
+http://localhost:3129/`, then your prometheus endpoint is `curl
+http://localhost:3129/prometheus/`.

antireplay/cache.go

@@ -0,0 +1,37 @@
+package antireplay
+
+import (
+	"github.com/allegro/bigcache"
+	"github.com/juju/errors"
+
+	"github.com/9seconds/mtg/config"
+)
+
+// Cache defines storage for obfuscated2 handshake frames.
+type Cache struct {
+	cache *bigcache.BigCache
+}
+
+func (a Cache) Add(frame []byte) {
+	a.cache.Set(string(frame), nil) // nolint: errcheck
+}
+
+func (a Cache) Has(frame []byte) bool {
+	_, err := a.cache.Get(string(frame))
+
+	return err == nil
+}
+
+func NewCache(config *config.Config) (Cache, error) {
+	cache, err := bigcache.NewBigCache(bigcache.Config{
+		Shards:           1024,
+		LifeWindow:       config.AntiReplayEvictionTime,
+		Hasher:           hasher{},
+		HardMaxCacheSize: config.AntiReplayMaxSize,
+	})
+	if err != nil {
+		return Cache{}, errors.Annotate(err, "Cannot make cache")
+	}
+
+	return Cache{cache}, nil
+}

antireplay/hasher.go

@@ -0,0 +1,9 @@
+package antireplay
+
+import "github.com/cespare/xxhash"
+
+type hasher struct{}
+
+func (h hasher) Sum64(value string) uint64 {
+	return xxhash.Sum64String(value)
+}

client/client.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"net"
 
+	"github.com/9seconds/mtg/antireplay"
 	"github.com/9seconds/mtg/config"
 	"github.com/9seconds/mtg/mtproto"
 	"github.com/9seconds/mtg/wrappers"
@@ -11,4 +12,4 @@ import (
 
 // Init defines common method for initializing client connections.
 type Init func(context.Context, context.CancelFunc, net.Conn, string,
-	*config.Config) (wrappers.Wrap, *mtproto.ConnectionOpts, error)
+	antireplay.Cache, *config.Config) (wrappers.Wrap, *mtproto.ConnectionOpts, error)

client/direct.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/juju/errors"
 
+	"github.com/9seconds/mtg/antireplay"
 	"github.com/9seconds/mtg/config"
 	"github.com/9seconds/mtg/mtproto"
 	"github.com/9seconds/mtg/obfuscated2"
@@ -18,7 +19,8 @@ const handshakeTimeout = 10 * time.Second
 // DirectInit initializes client connection for proxy which connects to
 // Telegram directly.
 func DirectInit(ctx context.Context, cancel context.CancelFunc, socket net.Conn,
-	connID string, conf *config.Config) (wrappers.Wrap, *mtproto.ConnectionOpts, error) {
+	connID string, antiReplayCache antireplay.Cache,
+	conf *config.Config) (wrappers.Wrap, *mtproto.ConnectionOpts, error) {
 	tcpSocket := socket.(*net.TCPConn)
 	if err := tcpSocket.SetNoDelay(false); err != nil {
 		return nil, nil, errors.Annotate(err, "Cannot disable NO_DELAY to client socket")
@@ -30,18 +32,24 @@ func DirectInit(ctx context.Context, cancel context.CancelFunc, socket net.Conn,
 		return nil, nil, errors.Annotate(err, "Cannot set write buffer size of client socket")
 	}
 
-	socket.SetReadDeadline(time.Now().Add(handshakeTimeout)) // nolint: errcheck
+	socket.SetReadDeadline(time.Now().Add(handshakeTimeout)) // nolint: errcheck, gosec
 	frame, err := obfuscated2.ExtractFrame(socket)
 	if err != nil {
 		return nil, nil, errors.Annotate(err, "Cannot extract frame")
 	}
-	socket.SetReadDeadline(time.Time{}) // nolint: errcheck
+	socket.SetReadDeadline(time.Time{}) // nolint: errcheck, gosec
 
 	conn := wrappers.NewConn(ctx, cancel, socket, connID, wrappers.ConnPurposeClient, conf.PublicIPv4, conf.PublicIPv6)
 	obfs2, connOpts, err := obfuscated2.ParseObfuscated2ClientFrame(conf.Secret, frame)
 	if err != nil {
 		return nil, nil, errors.Annotate(err, "Cannot parse obfuscated frame")
 	}
+
+	if antiReplayCache.Has([]byte(frame)) {
+		return nil, nil, errors.New("Replay attack is detected")
+	}
+	antiReplayCache.Add([]byte(frame))
+
 	connOpts.ConnectionProto = mtproto.ConnectionProtocolAny
 	connOpts.ClientAddr = conn.RemoteAddr()
 

client/middle.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"net"
 
+	"github.com/9seconds/mtg/antireplay"
 	"github.com/9seconds/mtg/config"
 	"github.com/9seconds/mtg/mtproto"
 	"github.com/9seconds/mtg/wrappers"
@@ -12,8 +13,9 @@ import (
 // MiddleInit initializes client connection for proxy which has to
 // support promoted channels, connect to Telegram middle proxies etc.
 func MiddleInit(ctx context.Context, cancel context.CancelFunc, socket net.Conn,
-	connID string, conf *config.Config) (wrappers.Wrap, *mtproto.ConnectionOpts, error) {
+	connID string, antiReplayCache antireplay.Cache,
-	conn, opts, err := DirectInit(ctx, cancel, socket, connID, conf)
+	conf *config.Config) (wrappers.Wrap, *mtproto.ConnectionOpts, error) {
+	conn, opts, err := DirectInit(ctx, cancel, socket, connID, antiReplayCache, conf)
 	if err != nil {
 		return nil, nil, err
 	}

config/config.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"net"
 	"strconv"
+	"time"
 
 	"github.com/juju/errors"
 	statsd "gopkg.in/alexcesaro/statsd.v2"
@@ -16,6 +17,7 @@ type Config struct {
 	Debug      bool
 	Verbose    bool
 	SecureMode bool
+	SecureOnly bool
 
 	ReadBufferSize  int
 	WriteBufferSize int
@@ -30,6 +32,9 @@ type Config struct {
 	PublicIPv6 net.IP
 	StatsIP    net.IP
 
+	AntiReplayMaxSize      int
+	AntiReplayEvictionTime time.Duration
+
 	StatsD struct {
 		Addr       net.Addr
 		Prefix     string
@@ -37,6 +42,9 @@ type Config struct {
 		TagsFormat statsd.TagFormat
 		Enabled    bool
 	}
+	Prometheus struct {
+		Prefix string
+	}
 
 	Secret []byte
 	AdTag  []byte
@@ -115,9 +123,11 @@ func NewConfig(debug, verbose bool, // nolint: gocyclo
 	bindIP, publicIPv4, publicIPv6, statsIP net.IP,
 	bindPort, publicIPv4Port, publicIPv6Port, statsPort, statsdPort uint16,
 	statsdIP, statsdNetwork, statsdPrefix, statsdTagsFormat string,
-	statsdTags map[string]string,
+	statsdTags map[string]string, prometheusPrefix string,
+	secureOnly bool,
+	antiReplayMaxSize int, antiReplayEvictionTime time.Duration,
 	secret, adtag []byte) (*Config, error) {
-	secureMode := false
+	secureMode := secureOnly
 	if bytes.HasPrefix(secret, []byte{0xdd}) && len(secret) == 17 {
 		secureMode = true
 		secret = bytes.TrimPrefix(secret, []byte{0xdd})
@@ -155,22 +165,26 @@ func NewConfig(debug, verbose bool, // nolint: gocyclo
 	}
 
 	conf := &Config{
-		Debug:           debug,
+		Debug:                  debug,
-		Verbose:         verbose,
+		Verbose:                verbose,
-		BindIP:          bindIP,
+		SecureOnly:             secureOnly,
-		BindPort:        bindPort,
+		BindIP:                 bindIP,
-		PublicIPv4:      publicIPv4,
+		BindPort:               bindPort,
-		PublicIPv4Port:  publicIPv4Port,
+		PublicIPv4:             publicIPv4,
-		PublicIPv6:      publicIPv6,
+		PublicIPv4Port:         publicIPv4Port,
-		PublicIPv6Port:  publicIPv6Port,
+		PublicIPv6:             publicIPv6,
-		StatsIP:         statsIP,
+		PublicIPv6Port:         publicIPv6Port,
-		StatsPort:       statsPort,
+		StatsIP:                statsIP,
-		Secret:          secret,
+		StatsPort:              statsPort,
-		AdTag:           adtag,
+		Secret:                 secret,
-		SecureMode:      secureMode,
+		AdTag:                  adtag,
-		ReadBufferSize:  int(readBufferSize),
+		SecureMode:             secureMode,
-		WriteBufferSize: int(writeBufferSize),
+		ReadBufferSize:         int(readBufferSize),
+		WriteBufferSize:        int(writeBufferSize),
+		AntiReplayMaxSize:      antiReplayMaxSize,
+		AntiReplayEvictionTime: antiReplayEvictionTime,
 	}
+	conf.Prometheus.Prefix = prometheusPrefix
 
 	if statsdIP != "" {
 		conf.StatsD.Enabled = true

config/global_ips.go

@@ -21,7 +21,7 @@ func getGlobalIPv6() (net.IP, error) {
 }
 
 func fetchIP(network string) (net.IP, error) {
-	dialer := &net.Dialer{DualStack: false}
+	dialer := &net.Dialer{FallbackDelay: -1}
 	client := &http.Client{
 		Jar: nil,
 		Transport: &http.Transport{

go.mod

@@ -0,0 +1,30 @@
+module github.com/9seconds/mtg
+
+replace github.com/golang/lint => github.com/golang/lint v0.0.0-20190227174305-8f45f776aaf1
+
+require (
+	github.com/OneOfOne/xxhash v1.2.5 // indirect
+	github.com/allegro/bigcache v1.2.0
+	github.com/beevik/ntp v0.2.0
+	github.com/cespare/xxhash v1.1.0
+	github.com/dustin/go-humanize v1.0.0
+	github.com/gofrs/uuid v3.2.0+incompatible
+	github.com/juju/errors v0.0.0-20190207033735-e65537c515d7
+	github.com/juju/loggo v0.0.0-20190526231331-6e530bcce5d8 // indirect
+	github.com/juju/testing v0.0.0-20190429233213-dfc56b8c09fc // indirect
+	github.com/kr/pretty v0.1.0 // indirect
+	github.com/pkg/errors v0.8.1 // indirect
+	github.com/prometheus/client_golang v0.9.4
+	github.com/spaolacci/murmur3 v1.1.0 // indirect
+	github.com/stretchr/testify v1.3.0
+	go.uber.org/atomic v1.4.0 // indirect
+	go.uber.org/multierr v1.1.0 // indirect
+	go.uber.org/zap v1.10.0
+	golang.org/x/net v0.0.0-20190607181551-461777fb6f67 // indirect
+	golang.org/x/sys v0.0.0-20190610200419-93c9922d18ae // indirect
+	gopkg.in/alecthomas/kingpin.v2 v2.2.6
+	gopkg.in/alexcesaro/statsd.v2 v2.0.0
+	gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 // indirect
+	gopkg.in/mgo.v2 v2.0.0-20180705113604-9856a29383ce // indirect
+	gopkg.in/yaml.v2 v2.2.2 // indirect
+)

go.sum

@@ -0,0 +1,115 @@
+github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
+github.com/OneOfOne/xxhash v1.2.5 h1:zl/OfRA6nftbBK9qTohYBJ5xvw6C/oNKizR7cZGl3cI=
+github.com/OneOfOne/xxhash v1.2.5/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q=
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc h1:cAKDfWh5VpdgMhJosfJnn5/FoN2SRZ4p7fJNX58YPaU=
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf h1:qet1QNfXsQxTZqLG4oE62mJzwPIB8+Tee4RNCL9ulrY=
+github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/allegro/bigcache v1.2.0 h1:qDaE0QoF29wKBb3+pXFrJFy1ihe5OT9OiXhg1t85SxM=
+github.com/allegro/bigcache v1.2.0/go.mod h1:Cb/ax3seSYIx7SuZdm2G2xzfwmv3TPSk2ucNfQESPXM=
+github.com/beevik/ntp v0.2.0 h1:sGsd+kAXzT0bfVfzJfce04g+dSRfrs+tbQW8lweuYgw=
+github.com/beevik/ntp v0.2.0/go.mod h1:hIHWr+l3+/clUnF44zdK+CWW7fO8dR5cIylAQ76NRpg=
+github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973 h1:xJ4a3vCFaGF/jqvzLMYoU8P317H5OQ+Via4RmuPwCS0=
+github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
+github.com/beorn7/perks v1.0.0 h1:HWo1m869IqiPhD389kmkxeTalrjNbbJTC8LXupb+sl0=
+github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
+github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
+github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dustin/go-humanize v1.0.0 h1:VSnTsYCnlFHaM2/igO1h6X3HA71jcobQuxemgkq4zYo=
+github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
+github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
+github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/gofrs/uuid v3.2.0+incompatible h1:y12jRkkFxsd7GpqdSZ+/KCs/fJbqpEXSGd4+jfEaewE=
+github.com/gofrs/uuid v3.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
+github.com/gogo/protobuf v1.1.1 h1:72R+M5VuhED/KujmZVcIquuo8mBgX4oVda//DQb3PXo=
+github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/golang/protobuf v1.2.0 h1:P3YflyNX/ehuJFLhxviNdFxQPkGK5cDcApsge1SqnvM=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.1 h1:YF8+flBXS5eO826T4nzqPrxfhQThhXl0YzfuUPu4SBg=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
+github.com/juju/errors v0.0.0-20190207033735-e65537c515d7 h1:dMIPRDg6gi7CUp0Kj2+HxqJ5kTr1iAdzsXYIrLCNSmU=
+github.com/juju/errors v0.0.0-20190207033735-e65537c515d7/go.mod h1:W54LbzXuIE0boCoNJfwqpmkKJ1O4TCTZMetAt6jGk7Q=
+github.com/juju/loggo v0.0.0-20190526231331-6e530bcce5d8 h1:UUHMLvzt/31azWTN/ifGWef4WUqvXk0iRqdhdy/2uzI=
+github.com/juju/loggo v0.0.0-20190526231331-6e530bcce5d8/go.mod h1:vgyd7OREkbtVEN/8IXZe5Ooef3LQePvuBm9UWj6ZL8U=
+github.com/juju/testing v0.0.0-20190429233213-dfc56b8c09fc h1:5xUWujf6ES9tEpFHFzI34vcHm8U07lGjxAuJML3qwqM=
+github.com/juju/testing v0.0.0-20190429233213-dfc56b8c09fc/go.mod h1:63prj8cnj0tU0S9OHjGJn+b1h0ZghCndfnbQolrYTwA=
+github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
+github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
+github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/pkg/errors v0.8.0 h1:WdK/asTD0HN+q6hsWO3/vpuAkAr+tw6aNJNDFFf0+qw=
+github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
+github.com/prometheus/client_golang v0.9.4 h1:Y8E/JaaPbmFSW2V81Ab/d8yZFYQQGbni1b1jPcG9Y6A=
+github.com/prometheus/client_golang v0.9.4/go.mod h1:oCXIBxdI62A4cR6aTRJCgetEjecSIYzOEaeAn4iYEpM=
+github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910 h1:idejC8f05m9MGOsuEi1ATq9shN03HrxNkD/luQvxCv8=
+github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
+github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90 h1:S/YWwWx/RA8rT8tKFRuGUZhuA90OyIBpPCXkcbwU8DE=
+github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/common v0.4.1 h1:K0MGApIoQvMw27RTdJkPbr3JZ7DNbtxQNyi5STVM6Kw=
+github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
+github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d h1:GoAlyOgbOEIFdaDqxJVlbOQ1DtGmZWs/Qau0hIlk+WQ=
+github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/prometheus/procfs v0.0.2 h1:6LJUbpNm42llc4HRCuvApCSWB/WfhuNo9K98Q9sNGfs=
+github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
+github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
+github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
+github.com/spaolacci/murmur3 v1.1.0 h1:7c1g84S4BPRrfL5Xrdp6fOJ206sU9y293DDHaoy0bLI=
+github.com/spaolacci/murmur3 v1.1.0/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.2.2 h1:bSDNvY7ZPG5RlJ8otE/7V6gMiyenm9RtJ7IUVIAoJ1w=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+go.uber.org/atomic v1.4.0 h1:cxzIVoETapQEqDhQu3QfnvXAV4AlzcvUCxkVUFw3+EU=
+go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
+go.uber.org/multierr v1.1.0 h1:HoEmRHQPVSqub6w2z2d2EOVs2fjyFRGyofhKuyDq0QI=
+go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
+go.uber.org/zap v1.10.0 h1:ORx85nbTijNz8ljznvCMR1ZBIPKFn3jQrag10X2AsuM=
+go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
+golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190607181551-461777fb6f67 h1:rJJxsykSlULwd2P2+pg/rtnwN2FrWp4IuCxOSyS0V00=
+golang.org/x/net v0.0.0-20190607181551-461777fb6f67/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4 h1:YUO/7uOKsKeq9UokNS62b8FYywz3ker1l1vDZRCRefw=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190610200419-93c9922d18ae h1:xiXzMMEQdQcric9hXtr1QU98MHunKK7OTtsoU6bYWs4=
+golang.org/x/sys v0.0.0-20190610200419-93c9922d18ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
+gopkg.in/alexcesaro/statsd.v2 v2.0.0 h1:FXkZSCZIH17vLCO5sO2UucTHsH9pc+17F6pl3JVCwMc=
+gopkg.in/alexcesaro/statsd.v2 v2.0.0/go.mod h1:i0ubccKGzBVNBpdGV5MocxyA/XlLUJzA7SLonnE4drU=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/mgo.v2 v2.0.0-20180705113604-9856a29383ce h1:xcEWjVhvbDy+nHP67nPDDpbYrY+ILlfndk4bRioVHaU=
+gopkg.in/mgo.v2 v2.0.0-20180705113604-9856a29383ce/go.mod h1:yeKp02qBN3iKW1OzL3MGk2IdtZzaj7SFntXj72NppTA=
+gopkg.in/yaml.v2 v2.2.1 h1:mUhvW9EsL+naU5Q3cakzfE91YhliOondGd6ZrsDBHQE=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

main.go

@@ -1,7 +1,5 @@
 package main
 
-//go:generate scripts/generate_version.sh
-
 import (
 	"encoding/json"
 	"fmt"
@@ -22,6 +20,8 @@ import (
 	"github.com/9seconds/mtg/stats"
 )
 
+var version = "dev" // this has to be set by build ld flags
+
 var (
 	app = kingpin.New("mtg", "Simple MTPROTO proxy.")
 
@@ -110,6 +110,12 @@ var (
 		Envar("MTG_STATSD_TAGS").
 		StringMap()
 
+	prometheusPrefix = app.Flag("prometheus-prefix",
+		"Which namespace to use to send stats to Prometheus.").
+		Envar("MTG_PROMETHEUS_PREFIX").
+		Default("mtg").
+		String()
+
 	writeBufferSize = app.Flag("write-buffer",
 		"Write buffer size in bytes. You can think about it as a buffer from client to Telegram.").
 		Short('w').
@@ -122,18 +128,32 @@ var (
 		Envar("MTG_BUFFER_READ").
 		Default("131072").
 		Uint32()
+	secureOnly = app.Flag("secure-only",
+		"Support clients with dd-secrets only.").
+		Short('s').
+		Envar("MTG_SECURE_ONLY").
+		Bool()
+
+	antiReplayMaxSize = app.Flag("anti-replay-max-size",
+		"Max size of antireplay cache in megabytes.").
+		Envar("MTG_ANTIREPLAY_MAXSIZE").
+		Default("128").
+		Int()
+	antiReplayEvictionTime = app.Flag("anti-replay-eviction-time",
+		"Eviction time period for obfuscated2 handshakes").
+		Envar("MTG_ANTIREPLAY_EVICTIONTIME").
+		Default("168h").
+		Duration()
 
 	secret = app.Arg("secret", "Secret of this proxy.").Required().HexBytes()
 	adtag  = app.Arg("adtag", "ADTag of the proxy.").HexBytes()
 )
 
-func init() {
+func main() { // nolint: gocyclo
 	rand.Seed(time.Now().UTC().UnixNano())
 	app.Version(version)
 	app.HelpFlag.Short('h')
-}
 
-func main() { // nolint: gocyclo
 	kingpin.MustParse(app.Parse(os.Args[1:]))
 
 	err := setRLimit()
@@ -146,7 +166,8 @@ func main() { // nolint: gocyclo
 		*bindIP, *publicIPv4, *publicIPv6, *statsIP,
 		*bindPort, *publicIPv4Port, *publicIPv6Port, *statsPort, *statsdPort,
 		*statsdIP, *statsdNetwork, *statsdPrefix, *statsdTagsFormat,
-		*statsdTags,
+		*statsdTags, *prometheusPrefix, *secureOnly,
+		*antiReplayMaxSize, *antiReplayEvictionTime,
 		*secret, *adtag,
 	)
 	if err != nil {
@@ -172,6 +193,7 @@ func main() { // nolint: gocyclo
 	defer logger.Sync() // nolint: errcheck
 
 	printURLs(conf.GetURLs())
+	zap.S().Debugw("Configuration", "config", conf)
 
 	if conf.UseMiddleProxy() {
 		zap.S().Infow("Use middle proxy connection to Telegram")
@@ -188,11 +210,14 @@ func main() { // nolint: gocyclo
 		zap.S().Infow("Use direct connection to Telegram")
 	}
 
-	if err := stats.Start(conf); err != nil {
+	if err := stats.Init(conf); err != nil {
 		panic(err)
 	}
 
-	server := proxy.NewProxy(conf)
+	server, err := proxy.NewProxy(conf)
+	if err != nil {
+		panic(err)
+	}
 	if err := server.Serve(); err != nil {
 		zap.S().Fatalw("Server stopped", "error", err)
 	}
@@ -227,6 +252,6 @@ func printURLs(data interface{}) {
 }
 
 func usage(msg string) {
-	io.WriteString(os.Stderr, msg+"\n") // nolint: errcheck
+	io.WriteString(os.Stderr, msg+"\n") // nolint: errcheck, gosec
 	os.Exit(1)
 }

mtproto/rpc/handshake_request.go

@@ -12,10 +12,10 @@ func (r *HandshakeRequest) Bytes() []byte {
 	buf := &bytes.Buffer{}
 	buf.Grow(len(TagHandshake) + len(HandshakeFlags) + len(HandshakeSenderPID) + len(HandshakePeerPID))
 
-	buf.Write(TagHandshake)
+	buf.Write(TagHandshake)       // nolint: gosec
-	buf.Write(HandshakeFlags)
+	buf.Write(HandshakeFlags)     // nolint: gosec
-	buf.Write(HandshakeSenderPID)
+	buf.Write(HandshakeSenderPID) // nolint: gosec
-	buf.Write(HandshakePeerPID)
+	buf.Write(HandshakePeerPID)   // nolint: gosec
 
 	return buf.Bytes()
 }

mtproto/rpc/handshake_response.go

@@ -19,10 +19,10 @@ type HandshakeResponse struct {
 func (r *HandshakeResponse) Bytes() []byte {
 	buf := &bytes.Buffer{}
 
-	buf.Write(r.Type)
+	buf.Write(r.Type)      // nolint: gosec
-	buf.Write(r.Flags)
+	buf.Write(r.Flags)     // nolint: gosec
-	buf.Write(r.SenderPID)
+	buf.Write(r.SenderPID) // nolint: gosec
-	buf.Write(r.PeerPID)
+	buf.Write(r.PeerPID)   // nolint: gosec
 
 	return buf.Bytes()
 }

mtproto/rpc/nonce_request.go

@@ -21,11 +21,11 @@ type NonceRequest struct {
 func (r *NonceRequest) Bytes() []byte {
 	buf := &bytes.Buffer{}
 
-	buf.Write(TagNonce)
+	buf.Write(TagNonce)       // nolint: gosec
-	buf.Write(r.KeySelector)
+	buf.Write(r.KeySelector)  // nolint: gosec
-	buf.Write(NonceCryptoAES)
+	buf.Write(NonceCryptoAES) // nolint: gosec
-	buf.Write(r.CryptoTS)
+	buf.Write(r.CryptoTS)     // nolint: gosec
-	buf.Write(r.Nonce)
+	buf.Write(r.Nonce)        // nolint: gosec
 
 	return buf.Bytes()
 }

mtproto/rpc/nonce_response.go

@@ -18,11 +18,11 @@ type NonceResponse struct {
 func (r *NonceResponse) Bytes() []byte {
 	buf := &bytes.Buffer{}
 
-	buf.Write(r.Type)
+	buf.Write(r.Type)        // nolint: gosec
-	buf.Write(r.KeySelector)
+	buf.Write(r.KeySelector) // nolint: gosec
-	buf.Write(r.Crypto)
+	buf.Write(r.Crypto)      // nolint: gosec
-	buf.Write(r.CryptoTS)
+	buf.Write(r.CryptoTS)    // nolint: gosec
-	buf.Write(r.Nonce)
+	buf.Write(r.Nonce)       // nolint: gosec
 
 	return buf.Bytes()
 }

mtproto/rpc/proxy_request.go

@@ -49,16 +49,16 @@ func (r *ProxyRequest) MakeHeader(message []byte) (*bytes.Buffer, fmt.Stringer)
 		flags |= proxyRequestFlagsEncrypted
 	}
 
-	buf.Write(TagProxyRequest)
+	buf.Write(TagProxyRequest)                 // nolint: gosec
-	buf.Write(flags.Bytes())
+	buf.Write(flags.Bytes())                   // nolint: gosec
-	buf.Write(r.ConnectionID)
+	buf.Write(r.ConnectionID)                  // nolint: gosec
-	buf.Write(r.ClientIPPort)
+	buf.Write(r.ClientIPPort)                  // nolint: gosec
-	buf.Write(r.OurIPPort)
+	buf.Write(r.OurIPPort)                     // nolint: gosec
-	buf.Write(ProxyRequestExtraSize)
+	buf.Write(ProxyRequestExtraSize)           // nolint: gosec
-	buf.Write(ProxyRequestProxyTag)
+	buf.Write(ProxyRequestProxyTag)            // nolint: gosec
-	buf.WriteByte(byte(len(r.ADTag)))
+	buf.WriteByte(byte(len(r.ADTag)))          // nolint: gosec
-	buf.Write(r.ADTag)
+	buf.Write(r.ADTag)                         // nolint: gosec
-	buf.Write(make([]byte, (4-buf.Len()%4)%4))
+	buf.Write(make([]byte, (4-buf.Len()%4)%4)) // nolint: gosec
 
 	return buf, flags
 }

mtproto/rpc/rpc.go

@@ -23,11 +23,6 @@ var (
 	ProxyRequestExtraSize = []byte{0x18, 0x00, 0x00, 0x00}
 	ProxyRequestProxyTag  = []byte{0xae, 0x26, 0x1e, 0xdb}
 
-	HandshakeSenderPID []byte
-	HandshakePeerPID   []byte
-)
-
-func init() {
 	HandshakeSenderPID = []byte("IPIPPRPDTIME")
-	HandshakePeerPID = []byte("IPIPPRPDTIME")
+	HandshakePeerPID   = []byte("IPIPPRPDTIME")
-}
+)

obfuscated2/frame.go

@@ -113,7 +113,7 @@ func generateFrame(connectionType mtproto.ConnectionType) Frame {
 		}
 
 		// error has to be checked before calling this function
-		tag, _ := connectionType.Tag() // nolint: errcheck
+		tag, _ := connectionType.Tag() // nolint: errcheck, gosec
 		copy(frame.Magic(), tag)
 
 		return frame

obfuscated2/frame_test.go

@@ -78,10 +78,10 @@ func TestFrameGenerateValid(t *testing.T) {
 	}
 	for _, test := range validTests {
 		t.Run(strconv.Itoa(int(test)), func(tt *testing.T) {
-			frame := generateFrame(test)
+			frame := generateFrame(test) // nolint: scopelint
 			conType, err := frame.ConnectionType()
-			assert.Nil(t, err)
+			assert.Nil(tt, err)
-			assert.Equal(t, conType, test)
+			assert.Equal(tt, conType, test) // nolint: scopelint
 		})
 	}
 }

obfuscated2/obfuscated2.go

@@ -23,14 +23,14 @@ type Obfuscated2 struct {
 // Beware, link above is in russian.
 func ParseObfuscated2ClientFrame(secret []byte, frame Frame) (*Obfuscated2, *mtproto.ConnectionOpts, error) {
 	decHasher := sha256.New()
-	decHasher.Write(frame.Key()) // nolint: errcheck
+	decHasher.Write(frame.Key()) // nolint: errcheck, gosec
-	decHasher.Write(secret)      // nolint: errcheck
+	decHasher.Write(secret)      // nolint: errcheck, gosec
 	decryptor := makeStreamCipher(decHasher.Sum(nil), frame.IV())
 
 	invertedFrame := frame.Invert()
 	encHasher := sha256.New()
-	encHasher.Write(invertedFrame.Key()) // nolint: errcheck
+	encHasher.Write(invertedFrame.Key()) // nolint: errcheck, gosec
-	encHasher.Write(secret)              // nolint: errcheck
+	encHasher.Write(secret)              // nolint: errcheck, gosec
 	encryptor := makeStreamCipher(encHasher.Sum(nil), invertedFrame.IV())
 
 	decryptedFrame := make(Frame, FrameLen)
@@ -76,6 +76,6 @@ func MakeTelegramObfuscated2Frame(opts *mtproto.ConnectionOpts) (*Obfuscated2, F
 }
 
 func makeStreamCipher(key, iv []byte) cipher.Stream {
-	block, _ := aes.NewCipher(key)
+	block, _ := aes.NewCipher(key) // nolint: gosec
 	return cipher.NewCTR(block, iv)
 }

obfuscated2/obfuscated2_test.go

@@ -47,8 +47,8 @@ func TestObfs2Full(t *testing.T) {
 
 	clientFrame := generateFrame(mtproto.ConnectionTypeIntermediate)
 	clientHasher := sha256.New()
-	clientHasher.Write(clientFrame.Key()) // nolint: errcheck
+	clientHasher.Write(clientFrame.Key()) // nolint: errcheck, gosec
-	clientHasher.Write(secret)            // nolint: errcheck
+	clientHasher.Write(secret)            // nolint: errcheck, gosec
 	clientKey := clientHasher.Sum(nil)
 
 	encryptor := makeStreamCipher(clientKey, clientFrame.IV())
@@ -58,8 +58,8 @@ func TestObfs2Full(t *testing.T) {
 
 	invertedClientFrame := clientFrame.Invert()
 	clientHasher = sha256.New()
-	clientHasher.Write(invertedClientFrame.Key()) // nolint: errcheck
+	clientHasher.Write(invertedClientFrame.Key()) // nolint: errcheck, gosec
-	clientHasher.Write(secret)                    // nolint: errcheck
+	clientHasher.Write(secret)                    // nolint: errcheck, gosec
 	invertedClientKey := clientHasher.Sum(nil)
 	clientDecryptor := makeStreamCipher(invertedClientKey, invertedClientFrame.IV())
 

proxy/proxy.go

@@ -6,10 +6,11 @@ import (
 	"net"
 	"sync"
 
+	"github.com/gofrs/uuid"
 	"github.com/juju/errors"
-	uuid "github.com/satori/go.uuid"
 	"go.uber.org/zap"
 
+	"github.com/9seconds/mtg/antireplay"
 	"github.com/9seconds/mtg/client"
 	"github.com/9seconds/mtg/config"
 	"github.com/9seconds/mtg/mtproto"
@@ -20,9 +21,10 @@ import (
 
 // Proxy is a core of this program.
 type Proxy struct {
-	clientInit client.Init
+	antiReplayCache antireplay.Cache
-	tg         telegram.Telegram
+	clientInit      client.Init
-	conf       *config.Config
+	tg              telegram.Telegram
+	conf            *config.Config
 }
 
 // Serve runs TCP proxy server.
@@ -42,13 +44,13 @@ func (p *Proxy) Serve() error {
 }
 
 func (p *Proxy) accept(conn net.Conn) {
-	connID := uuid.NewV4().String()
+	connID := uuid.Must(uuid.NewV4()).String()
 	log := zap.S().With("connection_id", connID).Named("main")
 	ctx, cancel := context.WithCancel(context.Background())
 
 	defer func() {
 		cancel()
-		conn.Close() // nolint: errcheck
+		conn.Close() // nolint: errcheck, gosec
 
 		if err := recover(); err != nil {
 			stats.NewCrash()
@@ -58,13 +60,18 @@ func (p *Proxy) accept(conn net.Conn) {
 
 	log.Infow("Client connected", "addr", conn.RemoteAddr())
 
-	clientConn, opts, err := p.clientInit(ctx, cancel, conn, connID, p.conf)
+	clientConn, opts, err := p.clientInit(ctx, cancel, conn, connID, p.antiReplayCache, p.conf)
 	if err != nil {
 		log.Errorw("Cannot initialize client connection", "error", err)
 		return
 	}
 	defer clientConn.(io.Closer).Close() // nolint: errcheck
 
+	if p.conf.SecureOnly && opts.ConnectionType != mtproto.ConnectionTypeSecure {
+		log.Errorw("Proxy supports only secure connections", "connection_type", opts.ConnectionType)
+		return
+	}
+
 	stats.ClientConnected(opts.ConnectionType, clientConn.RemoteAddr())
 	defer stats.ClientDisconnected(opts.ConnectionType, clientConn.RemoteAddr())
 
@@ -77,8 +84,8 @@ func (p *Proxy) accept(conn net.Conn) {
 
 	go func() {
 		<-ctx.Done()
-		serverConn.(io.Closer).Close()
+		serverConn.(io.Closer).Close() // nolint: gosec
-		clientConn.(io.Closer).Close()
+		clientConn.(io.Closer).Close() // nolint: gosec
 	}()
 
 	wait := &sync.WaitGroup{}
@@ -88,12 +95,12 @@ func (p *Proxy) accept(conn net.Conn) {
 		clientPacket := clientConn.(wrappers.PacketReadWriteCloser)
 		serverPacket := serverConn.(wrappers.PacketReadWriteCloser)
 		go p.middlePipe(clientPacket, serverPacket, wait, &opts.ReadHacks)
-		go p.middlePipe(serverPacket, clientPacket, wait, &opts.WriteHacks)
+		p.middlePipe(serverPacket, clientPacket, wait, &opts.WriteHacks)
 	} else {
 		clientStream := clientConn.(wrappers.StreamReadWriteCloser)
 		serverStream := serverConn.(wrappers.StreamReadWriteCloser)
 		go p.directPipe(clientStream, serverStream, wait, p.conf.ReadBufferSize)
-		go p.directPipe(serverStream, clientStream, wait, p.conf.WriteBufferSize)
+		p.directPipe(serverStream, clientStream, wait, p.conf.WriteBufferSize)
 	}
 
 	wait.Wait()
@@ -116,13 +123,8 @@ func (p *Proxy) getTelegramConn(ctx context.Context, cancel context.CancelFunc,
 	return packetConn, nil
 }
 
-func (p *Proxy) middlePipe(src wrappers.PacketReadCloser, dst io.WriteCloser,
+func (p *Proxy) middlePipe(src wrappers.PacketReadCloser, dst io.Writer, wait *sync.WaitGroup, hacks *mtproto.Hacks) {
-	wait *sync.WaitGroup, hacks *mtproto.Hacks) {
+	defer wait.Done()
-	defer func() {
-		src.Close() // nolint: errcheck
-		dst.Close() // nolint: errcheck
-		wait.Done()
-	}()
 
 	for {
 		hacks.SimpleAck = false
@@ -140,13 +142,8 @@ func (p *Proxy) middlePipe(src wrappers.PacketReadCloser, dst io.WriteCloser,
 	}
 }
 
-func (p *Proxy) directPipe(src wrappers.StreamReadCloser, dst io.WriteCloser,
+func (p *Proxy) directPipe(src wrappers.StreamReadCloser, dst io.Writer, wait *sync.WaitGroup, bufferSize int) {
-	wait *sync.WaitGroup, bufferSize int) {
+	defer wait.Done()
-	defer func() {
-		src.Close() // nolint: errcheck
-		dst.Close() // nolint: errcheck
-		wait.Done()
-	}()
 
 	buffer := make([]byte, bufferSize)
 	if _, err := io.CopyBuffer(dst, src, buffer); err != nil {
@@ -155,10 +152,15 @@ func (p *Proxy) directPipe(src wrappers.StreamReadCloser, dst io.WriteCloser,
 }
 
 // NewProxy returns new proxy instance.
-func NewProxy(conf *config.Config) *Proxy {
+func NewProxy(conf *config.Config) (*Proxy, error) {
 	var clientInit client.Init
 	var tg telegram.Telegram
 
+	cache, err := antireplay.NewCache(conf)
+	if err != nil {
+		return nil, errors.Annotate(err, "Cannot make proxy")
+	}
+
 	if conf.UseMiddleProxy() {
 		clientInit = client.MiddleInit
 		tg = telegram.NewMiddleTelegram(conf)
@@ -168,8 +170,9 @@ func NewProxy(conf *config.Config) *Proxy {
 	}
 
 	return &Proxy{
-		conf:       conf,
+		antiReplayCache: cache,
-		clientInit: clientInit,
+		conf:            conf,
-		tg:         tg,
+		clientInit:      clientInit,
-	}
+		tg:              tg,
+	}, nil
 }

scripts/generate_version.sh

@@ -1,12 +0,0 @@
-#!/bin/sh
-set -eu
-
-PROJECT_DIR="$(git rev-parse --show-toplevel)"
-OUTPUT_FILE="${PROJECT_DIR}/version.go"
-
-cat > "$OUTPUT_FILE" <<EOF
-package main
-// autogenerated by $(basename "$0") on $(date -Ru)
-
-const version = "$(git describe --long --always) ($(go version)) [$(date -Ru)]"
-EOF

stats/channels.go

@@ -2,21 +2,20 @@ package stats
 
 import (
 	"net"
-	"time"
 
 	"github.com/9seconds/mtg/mtproto"
 )
 
 const (
-	crashesChanLength     = 1
+	connectionsChanLength = 10
-	connectionsChanLength = 20
+	trafficChanLength     = 10
-	trafficChanLength     = 5000
 )
 
 var (
-	crashesChan     = make(chan struct{}, crashesChanLength)
+	crashesChan     = make(chan struct{})
-	connectionsChan = make(chan *connectionData, connectionsChanLength)
+	statsChan       = make(chan chan<- Stats)
-	trafficChan     = make(chan *trafficData, trafficChanLength)
+	connectionsChan = make(chan connectionData, connectionsChanLength)
+	trafficChan     = make(chan trafficData, trafficChanLength)
 )
 
 type connectionData struct {
@@ -30,81 +29,6 @@ type trafficData struct {
 	ingress bool
 }
 
-func crashManager() {
-	for range crashesChan {
-		instance.mutex.RLock()
-
-		instance.Crashes++
-
-		instance.mutex.RUnlock()
-	}
-}
-
-func connectionManager() {
-	for event := range connectionsChan {
-		instance.mutex.RLock()
-
-		isIPv4 := event.addr.IP.To4() != nil
-		var inc uint32 = 1
-		if !event.connected {
-			inc = ^uint32(0)
-		}
-
-		switch event.connectionType {
-		case mtproto.ConnectionTypeAbridged:
-			if isIPv4 {
-				instance.Connections.Abridged.IPv4 += inc
-			} else {
-				instance.Connections.Abridged.IPv6 += inc
-			}
-		case mtproto.ConnectionTypeSecure:
-			if isIPv4 {
-				instance.Connections.Secure.IPv4 += inc
-			} else {
-				instance.Connections.Secure.IPv6 += inc
-			}
-		default:
-			if isIPv4 {
-				instance.Connections.Intermediate.IPv4 += inc
-			} else {
-				instance.Connections.Intermediate.IPv6 += inc
-			}
-		}
-
-		instance.mutex.RUnlock()
-	}
-}
-
-func trafficManager() {
-	speedChan := time.Tick(time.Second)
-
-	for {
-		select {
-		case event := <-trafficChan:
-			instance.mutex.RLock()
-
-			if event.ingress {
-				instance.Traffic.Ingress += trafficValue(event.traffic)
-				instance.speedCurrent.Ingress += trafficSpeedValue(event.traffic)
-			} else {
-				instance.Traffic.Egress += trafficValue(event.traffic)
-				instance.speedCurrent.Egress += trafficSpeedValue(event.traffic)
-			}
-
-			instance.mutex.RUnlock()
-		case <-speedChan:
-			instance.mutex.RLock()
-
-			instance.Speed.Ingress = instance.speedCurrent.Ingress
-			instance.Speed.Egress = instance.speedCurrent.Egress
-			instance.speedCurrent.Ingress = trafficSpeedValue(0)
-			instance.speedCurrent.Egress = trafficSpeedValue(0)
-
-			instance.mutex.RUnlock()
-		}
-	}
-}
-
 // NewCrash indicates new crash.
 func NewCrash() {
 	crashesChan <- struct{}{}
@@ -112,7 +36,7 @@ func NewCrash() {
 
 // ClientConnected indicates that new client was connected.
 func ClientConnected(connectionType mtproto.ConnectionType, addr *net.TCPAddr) {
-	connectionsChan <- &connectionData{
+	connectionsChan <- connectionData{
 		connectionType: connectionType,
 		addr:           addr,
 		connected:      true,
@@ -121,7 +45,7 @@ func ClientConnected(connectionType mtproto.ConnectionType, addr *net.TCPAddr) {
 
 // ClientDisconnected indicates that client was disconnected.
 func ClientDisconnected(connectionType mtproto.ConnectionType, addr *net.TCPAddr) {
-	connectionsChan <- &connectionData{
+	connectionsChan <- connectionData{
 		connectionType: connectionType,
 		addr:           addr,
 		connected:      false,
@@ -130,7 +54,7 @@ func ClientDisconnected(connectionType mtproto.ConnectionType, addr *net.TCPAddr
 
 // IngressTraffic accounts new ingress traffic.
 func IngressTraffic(traffic int) {
-	trafficChan <- &trafficData{
+	trafficChan <- trafficData{
 		traffic: traffic,
 		ingress: true,
 	}
@@ -138,8 +62,15 @@ func IngressTraffic(traffic int) {
 
 // EgressTraffic accounts new ingress traffic.
 func EgressTraffic(traffic int) {
-	trafficChan <- &trafficData{
+	trafficChan <- trafficData{
 		traffic: traffic,
 		ingress: false,
 	}
 }
+
+// GetStats returns a snapshot of Stats instance.
+func GetStats() Stats {
+	rpcChan := make(chan Stats)
+	statsChan <- rpcChan
+	return <-rpcChan
+}

stats/init.go

@@ -0,0 +1,28 @@
+package stats
+
+import (
+	"github.com/juju/errors"
+
+	"github.com/9seconds/mtg/config"
+)
+
+// Init initializes stats subsystem.
+func Init(conf *config.Config) error {
+	if conf.StatsD.Enabled {
+		client, err := newStatsd(conf)
+		if err != nil {
+			return errors.Annotate(err, "Cannot initialize statsd client")
+		}
+		go client.run()
+	}
+	prometheus, err := newPrometheus(conf)
+	if err != nil {
+		return errors.Annotate(err, "Cannot initialize prometheus client")
+	}
+	go prometheus.run()
+
+	go NewStats(conf).start()
+	go startServer(conf, prometheus.getHTTPHandler())
+
+	return nil
+}

stats/prometheus.go

@@ -0,0 +1,91 @@
+package stats
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/juju/errors"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+
+	"github.com/9seconds/mtg/config"
+)
+
+const prometheusPollTime = time.Second
+
+type prometheusExporter struct {
+	registry prometheus.Gatherer
+
+	connections *prometheus.GaugeVec
+	traffic     *prometheus.GaugeVec
+	speed       *prometheus.GaugeVec
+	crashes     prometheus.Gauge
+}
+
+func (p *prometheusExporter) run() {
+	for range time.Tick(prometheusPollTime) {
+		instance := GetStats()
+
+		p.connections.WithLabelValues("abridged", "v4").Set(float64(instance.Connections.Abridged.IPv4))
+		p.connections.WithLabelValues("abridged", "v6").Set(float64(instance.Connections.Abridged.IPv6))
+		p.connections.WithLabelValues("intermediate", "v4").Set(float64(instance.Connections.Intermediate.IPv4))
+		p.connections.WithLabelValues("intermediate", "v6").Set(float64(instance.Connections.Intermediate.IPv6))
+		p.connections.WithLabelValues("secure", "v4").Set(float64(instance.Connections.Secure.IPv4))
+		p.connections.WithLabelValues("secure", "v6").Set(float64(instance.Connections.Secure.IPv6))
+		p.traffic.WithLabelValues("ingress").Set(float64(instance.Traffic.ingress))
+		p.traffic.WithLabelValues("egress").Set(float64(instance.Traffic.egress))
+		p.speed.WithLabelValues("ingress").Set(float64(instance.Speed.ingress))
+		p.speed.WithLabelValues("egress").Set(float64(instance.Speed.egress))
+		p.crashes.Set(float64(instance.Crashes))
+	}
+}
+
+func (p *prometheusExporter) getHTTPHandler() http.Handler {
+	return promhttp.HandlerFor(p.registry, promhttp.HandlerOpts{})
+}
+
+func newPrometheus(conf *config.Config) (*prometheusExporter, error) {
+	registry := prometheus.NewRegistry()
+
+	connections := prometheus.NewGaugeVec(prometheus.GaugeOpts{
+		Namespace: conf.Prometheus.Prefix,
+		Name:      "connections",
+		Help:      "Current number of connections to the proxy.",
+	}, []string{"type", "protocol"})
+	traffic := prometheus.NewGaugeVec(prometheus.GaugeOpts{
+		Namespace: conf.Prometheus.Prefix,
+		Name:      "traffic",
+		Help:      "Traffic passed through the proxy in bytes.",
+	}, []string{"direction"})
+	speed := prometheus.NewGaugeVec(prometheus.GaugeOpts{
+		Namespace: conf.Prometheus.Prefix,
+		Name:      "speed",
+		Help:      "Current throughput in bytes per second.",
+	}, []string{"direction"})
+	crashes := prometheus.NewGauge(prometheus.GaugeOpts{
+		Namespace: conf.Prometheus.Prefix,
+		Name:      "crashes",
+		Help:      "How many crashes happened.",
+	})
+
+	if err := registry.Register(connections); err != nil {
+		return nil, errors.Annotate(err, "Cannot register connections collector")
+	}
+	if err := registry.Register(traffic); err != nil {
+		return nil, errors.Annotate(err, "cannot register traffic collector")
+	}
+	if err := registry.Register(speed); err != nil {
+		return nil, errors.Annotate(err, "cannot register speed collector")
+	}
+	if err := registry.Register(crashes); err != nil {
+		return nil, errors.Annotate(err, "cannot register crashes collector")
+	}
+
+	return &prometheusExporter{
+		registry:    registry,
+		connections: connections,
+		traffic:     traffic,
+		speed:       speed,
+		crashes:     crashes,
+	}, nil
+}

stats/server.go

@@ -3,67 +3,38 @@ package stats
 import (
 	"encoding/json"
 	"net/http"
-	"sync"
-	"time"
 
 	"go.uber.org/zap"
 
 	"github.com/9seconds/mtg/config"
 )
 
-var instance *stats
+func startServer(conf *config.Config, prometheusHandler http.Handler) {
-
-// Start starts new statistics server.
-func Start(conf *config.Config) error {
 	log := zap.S().Named("stats")
 
-	instance = &stats{
+	http.HandleFunc("/", func(w http.ResponseWriter, _ *http.Request) {
-		URLs:   conf.GetURLs(),
-		Uptime: uptime(time.Now()),
-		mutex:  &sync.RWMutex{},
-	}
-
-	if conf.StatsD.Enabled {
-		client, err := newStatsd(conf)
-		if err != nil {
-			return err
-		}
-		go client.run()
-	}
-
-	go crashManager()
-	go connectionManager()
-	go trafficManager()
-
-	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
 
-		instance.mutex.Lock()
+		first, err := json.Marshal(GetStats())
-		first, err := json.Marshal(instance)
-		instance.mutex.Unlock()
-
 		if err != nil {
 			log.Errorw("Cannot encode json", "error", err)
 			http.Error(w, "Internal server error", 500)
 			return
 		}
 
-		interm := map[string]interface{}{}
+		interim := map[string]interface{}{}
-		json.Unmarshal(first, &interm) // nolint: errcheck
+		json.Unmarshal(first, &interim) // nolint: errcheck, gosec
 
 		encoder := json.NewEncoder(w)
 		encoder.SetEscapeHTML(false)
 		encoder.SetIndent("", "  ")
-		if err = encoder.Encode(interm); err != nil {
+		if err = encoder.Encode(interim); err != nil {
 			log.Errorw("Cannot encode json", "error", err)
 		}
 	})
+	http.Handle("/prometheus/", prometheusHandler)
 
-	go func() {
+	if err := http.ListenAndServe(conf.StatAddr(), nil); err != nil {
-		if err := http.ListenAndServe(conf.StatAddr(), nil); err != nil {
+		log.Fatalw("Stats server has been stopped", "error", err)
-			log.Fatalw("Stats server has been stopped", "error", err)
+	}
-		}
-	}()
-
-	return nil
 }

stats/stats.go

@@ -4,12 +4,12 @@ import (
 	"encoding/json"
 	"fmt"
 	"strconv"
-	"sync"
 	"time"
 
 	humanize "github.com/dustin/go-humanize"
 
 	"github.com/9seconds/mtg/config"
+	"github.com/9seconds/mtg/mtproto"
 )
 
 type uptime time.Time
@@ -24,72 +24,73 @@ func (u uptime) MarshalJSON() ([]byte, error) {
 	return json.Marshal(value)
 }
 
-type trafficValue uint64
+type connectionType struct {
-
+	IPv6 uint32 `json:"ipv6"`
-func (t trafficValue) MarshalJSON() ([]byte, error) {
+	IPv4 uint32 `json:"ipv4"`
-	tv := uint64(t)
-	value := map[string]interface{}{
-		"bytes": tv,
-		"human": humanize.Bytes(tv),
-	}
-
-	return json.Marshal(value)
 }
 
-type trafficSpeedValue uint64
+type baseConnections struct {
-
-func (t trafficSpeedValue) MarshalJSON() ([]byte, error) {
-	speed := uint64(t)
-	value := map[string]interface{}{
-		"bytes/s": speed,
-		"human":   fmt.Sprintf("%s/S", humanize.Bytes(speed)),
-	}
-
-	return json.Marshal(value)
-}
-
-type connections struct {
 	All          connectionType `json:"all"`
 	Abridged     connectionType `json:"abridged"`
 	Intermediate connectionType `json:"intermediate"`
 	Secure       connectionType `json:"secure"`
 }
 
+type connections struct {
+	baseConnections
+}
+
 func (c connections) MarshalJSON() ([]byte, error) {
 	c.All.IPv4 = c.Abridged.IPv4 + c.Intermediate.IPv4 + c.Secure.IPv4
 	c.All.IPv6 = c.Abridged.IPv6 + c.Intermediate.IPv6 + c.Secure.IPv6
 
-	value := struct {
+	return json.Marshal(c.baseConnections)
-		All          connectionType `json:"all"`
+}
-		Abridged     connectionType `json:"abridged"`
+
-		Intermediate connectionType `json:"intermediate"`
+type traffic struct {
-		Secure       connectionType `json:"secure"`
+	ingress uint64
-	}{
+	egress  uint64
-		All:          c.All,
+}
-		Abridged:     c.Abridged,
+
-		Intermediate: c.Intermediate,
+func (t *traffic) dumpValue(value uint64) map[string]interface{} {
-		Secure:       c.Secure,
+	return map[string]interface{}{
+		"bytes": value,
+		"human": humanize.Bytes(value),
+	}
+}
+
+func (t traffic) MarshalJSON() ([]byte, error) {
+	value := map[string]map[string]interface{}{
+		"ingress": t.dumpValue(t.ingress),
+		"egress":  t.dumpValue(t.egress),
 	}
 
 	return json.Marshal(value)
 }
 
-type connectionType struct {
-	IPv6 uint32 `json:"ipv6"`
-	IPv4 uint32 `json:"ipv4"`
-}
-
-type traffic struct {
-	Ingress trafficValue `json:"ingress"`
-	Egress  trafficValue `json:"egress"`
-}
-
 type speed struct {
-	Ingress trafficSpeedValue `json:"ingress"`
+	ingress uint64
-	Egress  trafficSpeedValue `json:"egress"`
+	egress  uint64
 }
 
-type stats struct {
+func (s *speed) dumpValue(value uint64) map[string]interface{} {
+	return map[string]interface{}{
+		"bytes/s": value,
+		"human":   fmt.Sprintf("%s/s", humanize.Bytes(value)),
+	}
+}
+
+func (s speed) MarshalJSON() ([]byte, error) {
+	value := map[string]map[string]interface{}{
+		"ingress": s.dumpValue(s.ingress),
+		"egress":  s.dumpValue(s.egress),
+	}
+
+	return json.Marshal(value)
+}
+
+// Stats represents a statistics of the proxy.
+type Stats struct {
 	URLs        config.IPURLs `json:"urls"`
 	Connections connections   `json:"connections"`
 	Traffic     traffic       `json:"traffic"`
@@ -97,6 +98,78 @@ type stats struct {
 	Uptime      uptime        `json:"uptime"`
 	Crashes     uint32        `json:"crashes"`
 
-	speedCurrent speed
+	previousTraffic traffic
-	mutex        *sync.RWMutex
+}
+
+func (s *Stats) start() {
+	speedChan := time.Tick(time.Second)
+
+	for {
+		select {
+		case <-speedChan:
+			s.handleSpeed()
+		case event := <-trafficChan:
+			s.handleTraffic(event)
+		case event := <-connectionsChan:
+			s.handleConnection(event)
+		case getStatsChan := <-statsChan:
+			s.handleGetStats(getStatsChan)
+		case <-crashesChan:
+			s.handleCrash()
+		}
+	}
+}
+
+func (s *Stats) handleTraffic(evt trafficData) {
+	if evt.ingress {
+		s.Traffic.ingress += uint64(evt.traffic)
+	} else {
+		s.Traffic.egress += uint64(evt.traffic)
+	}
+}
+
+func (s *Stats) handleSpeed() {
+	s.Speed.ingress = s.Traffic.ingress - s.previousTraffic.ingress
+	s.Speed.egress = s.Traffic.egress - s.previousTraffic.egress
+	s.previousTraffic.ingress = s.Traffic.ingress
+	s.previousTraffic.egress = s.Traffic.egress
+}
+
+func (s *Stats) handleConnection(evt connectionData) {
+	var inc uint32 = 1
+	if !evt.connected {
+		inc = ^uint32(0)
+	}
+
+	var conn *connectionType
+	switch evt.connectionType {
+	case mtproto.ConnectionTypeAbridged:
+		conn = &s.Connections.Abridged
+	case mtproto.ConnectionTypeSecure:
+		conn = &s.Connections.Secure
+	default:
+		conn = &s.Connections.Intermediate
+	}
+
+	if evt.addr.IP.To4() != nil {
+		conn.IPv4 += inc
+	} else {
+		conn.IPv6 += inc
+	}
+}
+
+func (s *Stats) handleGetStats(getStatsChan chan<- Stats) {
+	getStatsChan <- *s
+}
+
+func (s *Stats) handleCrash() {
+	s.Crashes++
+}
+
+// NewStats creates a new instance of Stats structure.
+func NewStats(conf *config.Config) *Stats {
+	return &Stats{
+		URLs:   conf.GetURLs(),
+		Uptime: uptime(time.Now()),
+	}
 }

stats/statsd.go

@@ -36,7 +36,7 @@ type statsdExporter struct {
 
 func (s *statsdExporter) run() {
 	for range time.Tick(statsdPollTime) {
-		instance.mutex.Lock()
+		instance := GetStats()
 
 		s.client.Gauge(statsdConnectionsAbridgedV4, instance.Connections.Abridged.IPv4)
 		s.client.Gauge(statsdConnectionsAbridgedV6, instance.Connections.Abridged.IPv6)
@@ -44,13 +44,11 @@ func (s *statsdExporter) run() {
 		s.client.Gauge(statsdConnectionsIntermediateV6, instance.Connections.Intermediate.IPv6)
 		s.client.Gauge(statsdConnectionsSecureV4, instance.Connections.Secure.IPv4)
 		s.client.Gauge(statsdConnectionsSecureV6, instance.Connections.Secure.IPv6)
-		s.client.Gauge(statsdTrafficIngress, uint64(instance.Traffic.Ingress))
+		s.client.Gauge(statsdTrafficIngress, instance.Traffic.ingress)
-		s.client.Gauge(statsdTrafficEgress, uint64(instance.Traffic.Egress))
+		s.client.Gauge(statsdTrafficEgress, instance.Traffic.egress)
-		s.client.Gauge(statsdSpeedIngress, uint64(instance.Speed.Ingress))
+		s.client.Gauge(statsdSpeedIngress, instance.Speed.ingress)
-		s.client.Gauge(statsdSpeedEgress, uint64(instance.Speed.Egress))
+		s.client.Gauge(statsdSpeedEgress, instance.Speed.egress)
 		s.client.Gauge(statsdCrashes, instance.Crashes)
-
-		instance.mutex.Unlock()
 	}
 }
 

telegram/direct.go

@@ -12,6 +12,11 @@ import (
 	"github.com/9seconds/mtg/wrappers"
 )
 
+const (
+	directV4DefaultIdx = 1
+	directV6DefaultIdx = 1
+)
+
 var (
 	directV4Addresses = map[int16][]string{
 		0: {"149.154.175.50:443"},
@@ -65,8 +70,10 @@ func NewDirectTelegram(conf *config.Config) Telegram {
 				Dialer: net.Dialer{Timeout: telegramDialTimeout},
 				conf:   conf,
 			},
-			v4Addresses: directV4Addresses,
+			v4DefaultIdx: directV4DefaultIdx,
-			v6Addresses: directV6Addresses,
+			v6DefaultIdx: directV6DefaultIdx,
+			v4Addresses:  directV4Addresses,
+			v6Addresses:  directV6Addresses,
 		},
 	}
 }

telegram/middle_caller.go

@@ -65,18 +65,20 @@ func (t *middleTelegramCaller) update() error {
 		return errors.Annotate(err, "Cannot get proxy secret")
 	}
 
-	v4Addresses, err := t.getTelegramAddresses(tgAddrProxyV4)
+	v4Addresses, v4DefaultIdx, err := t.getTelegramAddresses(tgAddrProxyV4)
 	if err != nil {
 		return errors.Annotate(err, "Cannot get ipv4 addresses")
 	}
 
-	v6Addresses, err := t.getTelegramAddresses(tgAddrProxyV6)
+	v6Addresses, v6DefaultIdx, err := t.getTelegramAddresses(tgAddrProxyV6)
 	if err != nil {
 		return errors.Annotate(err, "Cannot get ipv6 addresses")
 	}
 
 	t.dialerMutex.Lock()
 	t.proxySecret = secret
+	t.v4DefaultIdx = v4DefaultIdx
+	t.v6DefaultIdx = v6DefaultIdx
 	t.v4Addresses = v4Addresses
 	t.v6Addresses = v6Addresses
 	t.dialerMutex.Unlock()
@@ -101,52 +103,87 @@ func (t *middleTelegramCaller) getTelegramProxySecret() ([]byte, error) {
 	return secret, nil
 }
 
-func (t *middleTelegramCaller) getTelegramAddresses(url string) (map[int16][]string, error) {
+func (t *middleTelegramCaller) getTelegramAddresses(url string) (map[int16][]string, int16, error) { // nolint: gocyclo
 	resp, err := t.call(url)
 	if err != nil {
-		return nil, errors.Annotate(err, "Cannot access telegram server")
+		return nil, 0, errors.Annotate(err, "Cannot access telegram server")
 	}
 	defer resp.Body.Close() // nolint: errcheck
 
 	scanner := bufio.NewScanner(resp.Body)
 	data := map[int16][]string{}
+
+	var defaultIdx int16 = 1
 	for scanner.Scan() {
 		text := strings.TrimSpace(scanner.Text())
-		if strings.HasPrefix(text, "#") {
+		switch {
+		case strings.HasPrefix(text, "#"):
 			continue
-		}
+		case strings.HasPrefix(text, "proxy_for"):
-
+			addr, idx, err2 := t.parseProxyFor(text)
-		chunks := middleTelegramProxyConfigSplitter.Split(text, 3)
+			if err2 != nil {
-		if len(chunks) != 3 || chunks[0] != "proxy_for" {
+				return nil, 0, errors.Annotate(err2, "Cannot parse 'proxy_for' section")
-			return nil, errors.Errorf("Incorrect config '%s'", text)
+			}
-		}
+			if addresses, ok := data[idx]; ok {
-		dcIdx64, err2 := strconv.ParseInt(chunks[1], 10, 16)
+				data[idx] = append(addresses, addr)
-		if err2 != nil {
+			} else {
-			return nil, errors.Errorf("Incorrect config '%s'", text)
+				data[idx] = []string{addr}
-		}
+			}
-		dcIdx := int16(dcIdx64)
+		case strings.HasPrefix(text, "default"):
-
+			idx, err2 := t.parseDefault(text)
-		addr := strings.TrimRight(chunks[2], ";")
+			if err2 != nil {
-		if _, _, err2 = net.SplitHostPort(addr); err != nil {
+				return nil, 0, errors.Annotate(err2, "Cannot parse 'default' section")
-			return nil, errors.Annotatef(err2, "Incorrect config '%s'", text)
+			}
-		}
+			defaultIdx = idx
-
+		default:
-		if addresses, ok := data[dcIdx]; ok {
+			return nil, 0, errors.Errorf("Unknown config string '%s'", text)
-			data[dcIdx] = append(addresses, addr)
-		} else {
-			data[dcIdx] = []string{addr}
 		}
 	}
+
 	err = scanner.Err()
 	if err != nil {
-		return nil, errors.Annotate(err, "Cannot read response from the telegram")
+		return nil, 0, errors.Annotate(err, "Cannot read response from the telegram")
 	}
 
-	return data, nil
+	return data, defaultIdx, nil
+}
+
+func (t *middleTelegramCaller) parseProxyFor(text string) (string, int16, error) {
+	chunks := middleTelegramProxyConfigSplitter.Split(text, 3)
+	if len(chunks) != 3 || chunks[0] != "proxy_for" {
+		return "", 0, errors.Errorf("Incorrect config '%s'", text)
+	}
+
+	dcIdx, err := strconv.ParseInt(chunks[1], 10, 16)
+	if err != nil {
+		return "", 0, errors.Annotatef(err, "Incorrect config '%s'", text)
+	}
+
+	addr := strings.TrimRight(chunks[2], ";")
+	if _, _, err = net.SplitHostPort(addr); err != nil {
+		return "", 0, errors.Annotatef(err, "Incorrect config '%s'", text)
+	}
+
+	return addr, int16(dcIdx), nil
+}
+
+func (t *middleTelegramCaller) parseDefault(text string) (int16, error) {
+	chunks := middleTelegramProxyConfigSplitter.Split(text, 2)
+	if len(chunks) != 2 || chunks[0] != "default" {
+		return 0, errors.Errorf("Incorrect config '%s'", text)
+	}
+
+	dcIdxString := strings.TrimRight(chunks[1], ";")
+	dcIdx, err := strconv.ParseInt(dcIdxString, 10, 16)
+	if err != nil {
+		return 0, errors.Annotatef(err, "Incorrect config '%s'", text)
+	}
+
+	return int16(dcIdx), nil
 }
 
 func (t *middleTelegramCaller) call(url string) (*http.Response, error) {
-	req, _ := http.NewRequest("GET", url, nil)
+	req, _ := http.NewRequest("GET", url, nil) // nolint: gosec
 	req.Header.Set("Accept", "text/plain")
 	req.Header.Set("User-Agent", tgUserAgent)
 

telegram/telegram.go

@@ -19,8 +19,10 @@ type Telegram interface {
 type baseTelegram struct {
 	dialer tgDialer
 
-	v4Addresses map[int16][]string
+	v4DefaultIdx int16
-	v6Addresses map[int16][]string
+	v6DefaultIdx int16
+	v4Addresses  map[int16][]string
+	v6Addresses  map[int16][]string
 }
 
 func (b *baseTelegram) dial(ctx context.Context, cancel context.CancelFunc, dcIdx int16, connID string,
@@ -28,13 +30,13 @@ func (b *baseTelegram) dial(ctx context.Context, cancel context.CancelFunc, dcId
 	addrs := make([]string, 2)
 
 	if proto&mtproto.ConnectionProtocolIPv6 != 0 {
-		if addr, ok := b.v6Addresses[dcIdx]; ok && len(addr) > 0 {
+		if addr := b.chooseAddress(b.v6Addresses, dcIdx, b.v6DefaultIdx); addr != "" {
-			addrs = append(addrs, addr[rand.Intn(len(addr))])
+			addrs = append(addrs, addr)
 		}
 	}
 	if proto&mtproto.ConnectionProtocolIPv4 != 0 {
-		if addr, ok := b.v4Addresses[dcIdx]; ok && len(addr) > 0 {
+		if addr := b.chooseAddress(b.v4Addresses, dcIdx, b.v4DefaultIdx); addr != "" {
-			addrs = append(addrs, addr[rand.Intn(len(addr))])
+			addrs = append(addrs, addr)
 		}
 	}
 
@@ -46,3 +48,21 @@ func (b *baseTelegram) dial(ctx context.Context, cancel context.CancelFunc, dcId
 
 	return nil, errors.New("Cannot connect to Telegram")
 }
+
+func (b *baseTelegram) chooseAddress(addresses map[int16][]string, idx, defaultIdx int16) string {
+	if addr, ok := addresses[idx]; ok {
+		return b.chooseRandomAddress(addr)
+	} else if addr, ok := addresses[defaultIdx]; ok {
+		return b.chooseRandomAddress(addr)
+	}
+
+	return ""
+}
+
+func (b *baseTelegram) chooseRandomAddress(addresses []string) string {
+	if len(addresses) > 0 {
+		return addresses[rand.Intn(len(addresses))]
+	}
+
+	return ""
+}

wrappers/blockcipher.go

@@ -40,7 +40,7 @@ func (b *BlockCipher) Read(p []byte) (int, error) {
 	}
 
 	b.decryptor.CryptBlocks(buf, buf)
-	b.buf.Write(buf)
+	b.buf.Write(buf) // nolint: gosec
 
 	return b.flush(p)
 }

wrappers/conn.go

@@ -38,13 +38,6 @@ const (
 	connTimeoutWrite = 2 * time.Minute
 )
 
-type ioResult struct {
-	n   int
-	err error
-}
-
-type ioFunc func([]byte) (int, error)
-
 // Conn is a basic wrapper for net.Conn providing the most low-level
 // logic and management as possible.
 type Conn struct {
@@ -61,12 +54,20 @@ type Conn struct {
 func (c *Conn) Write(p []byte) (int, error) {
 	select {
 	case <-c.ctx.Done():
+		c.Close() // nolint: gosec
 		return 0, errors.Annotate(c.ctx.Err(), "Cannot write because context was closed")
 	default:
-		n, err := c.doIO(c.conn.Write, p, connTimeoutWrite)
+		if err := c.conn.SetWriteDeadline(time.Now().Add(connTimeoutWrite)); err != nil {
+			c.Close() // nolint: gosec
+			return 0, errors.Annotate(err, "Cannot set write deadline to the socket")
+		}
 
+		n, err := c.conn.Write(p)
 		c.logger.Debugw("Write to stream", "bytes", n, "error", err)
 		stats.EgressTraffic(n)
+		if err != nil {
+			c.Close() // nolint: gosec
+		}
 
 		return n, err
 	}
@@ -75,48 +76,30 @@ func (c *Conn) Write(p []byte) (int, error) {
 func (c *Conn) Read(p []byte) (int, error) {
 	select {
 	case <-c.ctx.Done():
+		c.Close() // nolint: gosec
 		return 0, errors.Annotate(c.ctx.Err(), "Cannot read because context was closed")
 	default:
-		n, err := c.doIO(c.conn.Read, p, connTimeoutRead)
+		if err := c.conn.SetReadDeadline(time.Now().Add(connTimeoutRead)); err != nil {
+			c.Close() // nolint: gosec
+			return 0, errors.Annotate(err, "Cannot set read deadline to the socket")
+		}
 
+		n, err := c.conn.Read(p)
 		c.logger.Debugw("Read from stream", "bytes", n, "error", err)
 		stats.IngressTraffic(n)
+		if err != nil {
+			c.Close() // nolint: gosec
+		}
 
 		return n, err
 	}
 }
 
-func (c *Conn) doIO(callback ioFunc, p []byte, timeout time.Duration) (int, error) {
-	resChan := make(chan ioResult, 1)
-	timer := time.NewTimer(timeout)
-
-	go func() {
-		n, err := callback(p)
-		resChan <- ioResult{n: n, err: err}
-	}()
-
-	select {
-	case res := <-resChan:
-		timer.Stop()
-		if res.err != nil {
-			c.Close()
-		}
-		return res.n, res.err
-	case <-c.ctx.Done():
-		timer.Stop()
-		c.Close()
-		return 0, errors.Annotate(c.ctx.Err(), "Cannot do IO because context is closed")
-	case <-timer.C:
-		c.Close()
-		return 0, errors.Annotate(c.ctx.Err(), "Timeout on IO operation")
-	}
-}
-
 // Close closes underlying net.Conn instance.
 func (c *Conn) Close() error {
-	defer c.logger.Debugw("Close connection")
+	c.logger.Debugw("Close connection")
-
 	c.cancel()
+
 	return c.conn.Close()
 }
 

wrappers/mtproto_abridged.go

@@ -119,9 +119,9 @@ func (m *MTProtoAbridged) Write(p []byte) (int, error) {
 		buf := &bytes.Buffer{}
 		buf.Grow(1 + 3 + len(p))
 
-		buf.WriteByte(byte(mtprotoAbridgedSmallPacketLength))
+		buf.WriteByte(byte(mtprotoAbridgedSmallPacketLength)) // nolint: gosec
-		buf.Write(length24[:])
+		buf.Write(length24[:])                                // nolint: gosec
-		buf.Write(p)
+		buf.Write(p)                                          // nolint: gosec
 
 		return m.conn.Write(buf.Bytes())
 	}

wrappers/mtproto_cipher.go

@@ -4,8 +4,8 @@ import (
 	"bytes"
 	"crypto/aes"
 	"crypto/cipher"
-	"crypto/md5" // nolint: gas
+	"crypto/md5"  // nolint: gas
-	"crypto/sha1"
+	"crypto/sha1" // nolint: gosec
 	"encoding/binary"
 	"net"
 
@@ -41,9 +41,9 @@ func NewMiddleProxyCipher(conn StreamReadWriteCloser,
 func deriveKeys(purpose cipherPurpose, req *rpc.NonceRequest, resp *rpc.NonceResponse,
 	client, remote *net.TCPAddr, secret []byte) ([]byte, []byte) {
 	message := bytes.Buffer{}
-	message.Write(resp.Nonce)
+	message.Write(resp.Nonce)   // nolint: gosec
-	message.Write(req.Nonce)
+	message.Write(req.Nonce)    // nolint: gosec
-	message.Write(req.CryptoTS)
+	message.Write(req.CryptoTS) // nolint: gosec
 
 	clientIPv4 := emptyIP[:]
 	serverIPv4 := emptyIP[:]
@@ -51,36 +51,36 @@ func deriveKeys(purpose cipherPurpose, req *rpc.NonceRequest, resp *rpc.NonceRes
 		clientIPv4 = utils.ReverseBytes(client.IP.To4())
 		serverIPv4 = utils.ReverseBytes(remote.IP.To4())
 	}
-	message.Write(serverIPv4)
+	message.Write(serverIPv4) // nolint: gosec
 
 	var port [2]byte
 	binary.LittleEndian.PutUint16(port[:], uint16(client.Port))
-	message.Write(port[:])
+	message.Write(port[:]) // nolint: gosec
 
 	switch purpose {
 	case cipherPurposeClient:
-		message.WriteString("CLIENT")
+		message.WriteString("CLIENT") // nolint: gosec
 	case cipherPurposeServer:
-		message.WriteString("SERVER")
+		message.WriteString("SERVER") // nolint: gosec
 	default:
 		panic("Unexpected cipher purpose")
 	}
 
-	message.Write(clientIPv4)
+	message.Write(clientIPv4) // nolint: gosec
 	binary.LittleEndian.PutUint16(port[:], uint16(remote.Port))
-	message.Write(port[:])
+	message.Write(port[:])    // nolint: gosec
-	message.Write(secret)
+	message.Write(secret)     // nolint: gosec
-	message.Write(resp.Nonce)
+	message.Write(resp.Nonce) // nolint: gosec
 
 	if client.IP.To4() == nil {
-		message.Write(client.IP.To16())
+		message.Write(client.IP.To16()) // nolint: gosec
-		message.Write(remote.IP.To16())
+		message.Write(remote.IP.To16()) // nolint: gosec
 	}
-	message.Write(req.Nonce)
+	message.Write(req.Nonce) // nolint: gosec
 
 	data := message.Bytes()
 	md5sum := md5.Sum(data[1:]) // nolint: gas
-	sha1sum := sha1.Sum(data)
+	sha1sum := sha1.Sum(data)   // nolint: gosec
 
 	key := append(md5sum[:12], sha1sum[:]...)
 	iv := md5.Sum(data[2:]) // nolint: gas

wrappers/mtproto_frame.go

@@ -73,12 +73,12 @@ func (m *MTProtoFrame) Read() ([]byte, error) { // nolint: gocyclo
 	}
 
 	var seqNo int32
-	binary.Read(buf, binary.LittleEndian, &seqNo) // nolint: errcheck
+	binary.Read(buf, binary.LittleEndian, &seqNo) // nolint: errcheck, gosec
 	if seqNo != m.readSeqNo {
 		return nil, errors.Errorf("Unexpected sequence number %d (wait for %d)", seqNo, m.readSeqNo)
 	}
 
-	data, _ := ioutil.ReadAll(buf)
+	data, _ := ioutil.ReadAll(buf) // nolint: gosec
 	buf.Reset()
 	// write to buf, not to writer. This is because we are going to fetch
 	// crc32 checksum.
@@ -109,13 +109,13 @@ func (m *MTProtoFrame) Write(p []byte) (int, error) {
 	buf := &bytes.Buffer{}
 	buf.Grow(messageLength + paddingLength)
 
-	binary.Write(buf, binary.LittleEndian, uint32(messageLength)) // nolint: errcheck
+	binary.Write(buf, binary.LittleEndian, uint32(messageLength)) // nolint: errcheck, gosec
-	binary.Write(buf, binary.LittleEndian, m.writeSeqNo)          // nolint: errcheck
+	binary.Write(buf, binary.LittleEndian, m.writeSeqNo)          // nolint: errcheck, gosec
-	buf.Write(p)
+	buf.Write(p)                                                  // nolint: gosec
 
 	checksum := crc32.ChecksumIEEE(buf.Bytes())
-	binary.Write(buf, binary.LittleEndian, checksum) // nolint: errcheck
+	binary.Write(buf, binary.LittleEndian, checksum)              // nolint: errcheck, gosec
-	buf.Write(bytes.Repeat(mtprotoFramePadding, paddingLength/4))
+	buf.Write(bytes.Repeat(mtprotoFramePadding, paddingLength/4)) // nolint: gosec
 
 	m.logger.Debugw("Write MTProto frame",
 		"length", len(p),

wrappers/mtproto_intermediate_secure.go

@@ -44,9 +44,9 @@ func (m *MTProtoIntermediateSecure) Write(p []byte) (int, error) {
 	paddingLength := rand.Intn(4)
 	buf.Grow(4 + len(p) + paddingLength)
 
-	binary.Write(buf, binary.LittleEndian, uint32(len(p)+paddingLength)) // nolint: errcheck
+	binary.Write(buf, binary.LittleEndian, uint32(len(p)+paddingLength)) // nolint: errcheck, gosec
-	buf.Write(p)
+	buf.Write(p)                                                         // nolint: gosec
-	buf.Write(make([]byte, paddingLength))
+	buf.Write(make([]byte, paddingLength))                               // nolint: gosec
 
 	m.logger.Debugw("Write packet with padding",
 		"simple_ack", m.opts.WriteHacks.SimpleAck,

wrappers/mtproto_proxy.go

@@ -120,7 +120,7 @@ func (m *MTProtoProxy) Write(p []byte) (int, error) {
 			zap.Stringer("flags", flags),
 		)
 	}
-	header.Write(p)
+	header.Write(p) // nolint: gosec
 
 	if _, err := m.conn.Write(header.Bytes()); err != nil {
 		return 0, err

wrappers/streamcipher.go

@@ -34,7 +34,7 @@ func (s *StreamCipher) Write(p []byte) (int, error) {
 
 	buf.Reset()
 	buf.Grow(len(p))
-	buf.Write(p)
+	buf.Write(p) // nolint: gosec
 
 	data := buf.Bytes()
 	s.encryptor.XORKeyStream(data, data)

wrappers/streamcipher_pool.go

@@ -5,12 +5,10 @@ import (
 	"sync"
 )
 
-var streamCipherBufferPool sync.Pool
+var (
-
-func init() {
 	streamCipherBufferPool = sync.Pool{
 		New: func() interface{} {
 			return &bytes.Buffer{}
 		},
 	}
-}
+)